Enumeration

As we learned earlier in this chapter, enumeration is always one of the first steps (and repeated several times, depending on what the adversary can access) to get more details about an environment. Enumeration helps to find out what resources are available and what access rights can be abused.

Of course, enumeration is a task that is not only helpful for red teamers but also for blue teamers to regularly audit permissions. It is better to see what can be enumerated in your own environment and fix/adjust it before an attacker finds out.

In AD, every user who has access to the corporate network can enumerate all user accounts, as well as (high-privileged) group membership. In Azure Active Directory (AAD), every user who has access to Office 365 services via the internet can enumerate AAD user accounts and group membership in their tenant.

Let’s start looking into enumeration in AD in this chapter. Refer to the next chapter to find out how enumeration works...