Active Directory Trusts and Lateral Movement Paths
Forest trusts and SIDHistory, SCCM, WSUS, LDAP enumeration and the four different execution paths behind WinRM, WMI, DCOM and PsExec.
Lateral movement in a domain is rarely one technique. It is a trust relationship, a management product that already has remote execution, and a protocol choice that decides what the logs show.
Active Directory Trusts
A compromised domain does not necessarily end at its own domain boundary. Trusts define which identities may cross it. Trusts connect domains and forests for authentication and resource access. Direction, transitivity and selective authentication change reach. Parent-child trusts inside one forest carry stronger relationships than forest trusts between separate organizations. SID filtering also changes SIDHistory-based paths. I enumerate trusts, direction, attributes, SID filtering and cross-domain group membership before testing access across the boundary. Impact should not be called forest compromise just because a trust exists. The path needs to show which identity crosses, which resource accepts it and what control exists on the other side.
1
impacket-lookupsid lab.local/gabriel:'Password123!'@dc01.lab.local
SCCM and MECM
A product designed to install software on thousands of machines already holds exactly the kind of power an attacker wants. Microsoft Configuration Manager manages clients, distributes content and performs actions under privileged identities. Management Points, Distribution Points, Network Access Accounts, client push and collection administration create relationships that need mapping. I identify sites, MPs, DPs, service accounts, boundaries and which principals can create deployments or change collections. Impact grows when a low-privileged identity controls content or targeting that reaches sensitive servers. The administrative chain matters more than one old secret.
1
nmap -sV -p80,443,445,8530,8531 sccm.lab.local
LDAP
When BloodHound shows a strange relationship, LDAP is one of the fastest ways to see the actual attribute behind it. Active Directory exposes much of the directory through LDAP. Users, groups, computers, SPNs, delegation and ACL-related metadata can be queried directly. Base DN, filters, attributes and controls define query quality. Asking for everything in a large forest creates noise and unnecessary cost. I start with RootDSE, discover naming contexts and write small filters that answer one question at a time. Plain LDAP also introduces signing and channel-binding considerations when integrated authentication is involved.
1
ldapsearch -x -H ldap://10.10.10.10 -D 'gabriel@lab.local' -w 'Password123!' -b 'DC=lab,DC=local' '(servicePrincipalName=*)' sAMAccountName servicePrincipalName
WinRM, WMI, DCOM and PsExec
Four techniques may all end in remote command execution on Windows while producing very different prerequisites, contexts and artifacts. WinRM uses WS-Management. WMI and DCOM use RPC and COM. PsExec-style execution commonly creates a remote service through SMB and the Service Control Manager. Firewall rules, Remote UAC restrictions, admin shares, token filtering and local group membership change viability. I validate ports, authentication and privilege with a harmless action before choosing an execution channel. A tool that authenticates successfully may still fail to execute. Remote UAC and missing local privilege often explain that gap.
1
2
nxc winrm 10.10.10.20 -u Administrator -p 'Password123!'
nxc wmi 10.10.10.20 -u Administrator -p 'Password123!'
WSUS
WSUS controls which Windows packages clients trust and where update metadata comes from. That position already deserves high-tier treatment. Windows Server Update Services distributes metadata and updates to clients configured by policy. HTTP, signing and server administration affect risk. Legacy environments may use HTTP for communication and internal proxies. Administrative compromise of WSUS affects a large host population. I enumerate WSUS GPO settings, configured URLs, TLS and who can administer the server and approvals. Microsoft update binaries are signed, but approvals, third-party publishing and server trust still create separate attack paths.
1
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /s