---
name: rt-scenario-n003
description: "N-003: Active Directory attack-path mapping with BloodHound-style relationship analysis. Domain: network. Authorized scenario for identifying privilege paths, validating control gaps, and building remediation plans."
---

# N-003: Active Directory Attack Path Mapping

## Overview

This scenario evaluates whether normal or low-privileged domain relationships can create a path to high-value assets such as Domain Admins, server admins, backup systems, or sensitive file shares. It emphasizes graph analysis, safe validation, and remediation.

| Field | Value |
|---|---|
| Domain | Active Directory |
| Objective | Identify and prioritize privilege paths |
| Required Access | Domain user or approved directory data export |
| Detection Risk | Low to Medium |
| Primary Impact | Privilege escalation and domain compromise path |

## Prerequisites

- Domain scope approved.
- Collection method approved.
- Account used for collection documented.
- Sensitive group list agreed with client.
- No privilege modification unless explicitly approved.

## Attack Chain Model

1. Collect directory relationship data.
2. Import graph into analysis tooling.
3. Identify paths from low privilege to high-value principals.
4. Validate each edge with read-only evidence where possible.
5. Recommend changes that break the path earliest.

## Workflow

### Step 1 - Define Crown Jewels

Examples:

- Domain Admins.
- Enterprise Admins.
- Backup operators.
- Tier 0 servers.
- CI/CD service accounts.
- Sensitive file shares.

### Step 2 - Collect Relationship Data

Use the collection method approved by the client. Record collection time, account, domain, and data retention plan.

### Step 3 - Analyze Paths

Prioritize paths involving:

- GenericAll / GenericWrite.
- WriteDACL / WriteOwner.
- AddMember rights.
- Unconstrained or risky delegation.
- Local admin paths to servers.
- Kerberoastable privileged service accounts.
- Stale privileged users.

### Step 4 - Validate Safely

For each edge, capture configuration evidence instead of changing privileges:

| Edge | Safe Proof |
|---|---|
| Group membership control | ACL screenshot/export |
| Local admin path | Client-approved admin mapping |
| Delegation | AD attribute evidence |
| Service account risk | SPN and privilege context |

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Discovery | Discovery | Account Discovery |
| Privilege Path | Privilege Escalation | Domain Policy Modification |
| Access | Defense Evasion / Persistence | Valid Accounts |

## Evidence

- Path screenshot.
- Edge details.
- Affected principals.
- Business owner if known.
- Recommended break point.

## Remediation

- Remove unnecessary delegated rights.
- Apply tiered administration.
- Clean stale groups and users.
- Limit local admin sprawl.
- Review service account privileges.
- Monitor changes to privileged ACLs and groups.

