Enumeration using built-in capabilities

In our scenario, we have established an initial foothold, successfully identifying and evading defensive security measures. For the next step, we need a better understanding of the environment we have landed in. All our reconnaissance actions could be under close monitoring by the blue team. Later, we will run various commands and tools, examine Windows event logs, and generate traffic. The purpose of such an exercise is to understand what protocols are used under the hood and what indicators of compromise can be left during enumeration.

Before jumping to the hands-on part, let us go through a brief overview of the enumeration methodology we are going to follow. My approach will be to go from a higher level of abstraction to a low one.

PowerShell cmdlet

We are going to enumerate an Active Directory environment, starting with forests, domains, and trust relationships between them. For the next step, we will enumerate each domain separately...