Red Team Tips February 1st: OPSEC Safe Active Directory Enumeration with SilentHound

[@nickswink7983]

Hey I'm the developer, thanks for the walkthrough!

[@nickswink7983]

One thing I would add is it supports pass-the-hash as well. So you don't need a plaintext password, and you can use just the NTLM hash if thats all you have

[@CyberAttackDefense]

Nice thanks for the update!

[@crash9706]

Wow, thanks for this content. This is very good stuff. Can we get some videos on how to setup red team infrastructure in the cloud maybe ? Also generally how to operate on a c2 in opsec way. What things to look for when first getting initial shell or beacon. I know I'm throwing a lot and it's very generic and wide space to cover. Thanks 👍

[@CyberAttackDefense]

Great suggestion! I can slowly cover those topics over time!

[@Clutchisback1PC]

This channel is effing gold...

[@CyberAttackDefense]

Glad you are enjoying the content. Tell your friends!

[@joyemoticon]

Absolutely!

[@almillar7280]

legit is!!! Thanks so much CyberAttackDefence!!

[@almillar7280]

Is the query it runs signature-able? I suspect it probably not.a query many would consider as "normal" ldap traffic? Would it not just be more stealthy to enumerate the environment slowly using something like sharpview?

[@CyberAttackDefense]

To be honest none of this is super stealthy. Not many orgs log LDAP queries. Sharpview depending on what you use would be less stealthy than this.

[@almillar7280]

Thanks for reply.... any ideas on how someone could enumerate AD with maximal stealth?

[@maxrand6611]

Are there dependencies for the python script?

[@CyberAttackDefense]

Yes there are dependencies. Do a pip3 -r requirement.txt for the silenthound.py

[@joyemoticon]

Thanks!

[@CyberAttackDefense]

You bet!

[@morinc75]

curious to see if this would trip up a honeypot account

[@CyberAttackDefense]

If you point it at a honeypot it would trigger for sure. Redteams need to do their OPSEC enumeration. Typically honeypots will have some telltale signs.