Skip to content

AD Workflow Playbooks

Overview

Attack Path Umbryx ships a set of built-in playbooks that automate typical tasks in Active Directory environments. No code required — fill in the run form fields and go.

All AD playbooks are designed to work with Batch Run — one playbook executed on multiple DCs/hosts at once.

Built-in AD playbooks

ad-ldap-enum — AD LDAP Enumeration

Enumerates users, groups, computers and the password policy via NetExec LDAP.

Steps: 1. NetExec LDAP — --users --groups --computers --password-not-required --admin-count --trusted-for-delegation

Requires: domain credentials (username / password or hash)

Typical usage:

  • Pick the playbook → Single Run → fill Target (DC IP) + credentials → Run
  • Or Batch Run across hosts tagged dc

ad-spray-smb — AD SMB Password Spray

Tests a single username:password pair against a list of SMB hosts. Uses --continue-on-success --no-bruteforce — does not lock out accounts.

Steps: 1. NetExec SMB spray

Requires: username + password (or hash) in the run form

Typical usage:

  • Batch Run over all project hosts (or those tagged domain) with parallelism=5
  • Successful authentications automatically update host status via connectors

ad-full-enum — AD Full Enumeration Chain

Comprehensive DC recon in one run: port scan → LDAP enum → ADCS enum → SPN discovery → Kerberoast → delegation enum → topology update.

Steps: 1. Nmap -p 53,88,135,139,389,443,445,464,636,3268,3269,5985 -sV --open 2. NetExec LDAP — users/groups/computers 3. NetExec ADCS (--adcs) — certificate templates 4. SPN discovery 5. impacket-GetUserSPNs (Kerberoast) 6. Delegation enumeration 7. Topology auto-build

Requires: target (DC IP), domain + username + password, attacker_ssh and nmap connectors

Typical usage: Batch Run across hosts tagged dc, parallelism=1–2

ad-bloodhound — BloodHound Collection

Runs the BloodHound collector on the target and imports the resulting graph into the project (see also the BloodHound import in the UI).

Requires: domain credentials, attacker_ssh connector

ad-spray-smb / ad-spray-winrm — Credential Spraying

NetExec password spray over SMB or WinRM with --continue-on-success --no-bruteforce; successful authentications update host status and create access edges automatically.

Requires: a cred pack or domain/username/password in the run form

Custom AD steps in the editor

Besides the built-in playbooks, the custom playbook editor offers step templates:

Template Description
Kerberoast (impacket) GetUserSPNs with credential substitution
AS-REP Roast (impacket) GetNPUsers with a usersfile
LDAP Dump (ldapdomaindump) Dump AD objects via ldapdomaindump
NetExec LDAP Enum netexec ldap with full-enumeration flags
NetExec SMB Spray password spray with continue-on-success

All templates come with pre-filled commands. The {target}, {domain}, {username}, {password}, {hash} variables are substituted from the run form at execution time.

Tooling setup

The AD playbooks assume the following tools on the attacker box:

# Impacket
pip3 install impacket
# or via pipx
pipx install impacket

# ldapdomaindump
pip3 install ldapdomaindump

# NetExec (already in connectors)
# ...configured under Infra → Connections

The Attacker SSH target must be configured in Infra → Connections with a valid SSH host.

Example: full AD recon in 3 steps

1. Configure the attacker_ssh target (Infra → Connections)
2. Batch Run → ad-full-enum → Tag filter: "dc" →
   credentials: domain=CORP, username=svc_account, password=P@ss
   → parallelism=1 → Run on N hosts
3. Review results in Playbook Runs → expand the run →
   filter jobs by playbook_run_id

Tickets for cracking end up in /tmp/kerberoast_<DC_IP>.txt on the attacker box. The user/group dump — in the netexec job output. The topology graph — updated automatically by the last step.