Active › Module 4 › Lesson 3
Enum Hygiene
Enum hygiene limits blast radius — scope, logging, rate, and data handling on $LAB_AD; defenders detect noisy LDAP.
Visual · t25_enum_hygiene
Enum hygiene literacy. $LAB_AD only. Original Cyberlium.
Opening
Noisy enum without scope is indistinguishable from attack — hygiene keeps YOUR lab work ethical and measurable.
Before any LDAP or graph collector on $LAB_AD: confirm RoE, snapshot VM, note start/end time, use dedicated lab account, throttle queries in shared ranges, store outputs chmod 600, redact if sharing screenshots. Defenders alert on mass LDAP binds, unusual service account enum, and off-hours BloodHound ingest patterns. Cyberlium documents enum hygiene checklist — not full enumeration cookbooks against stranger DCs. Next: Enum Lab.
1. Pre-enum checklist (named)
Verify $LAB_AD scope file signed or course-enrolled. Confirm DC IP in inventory. Snapshot. Dedicated low-priv lab user — not domain admin for routine enum literacy.
Log tool name and version; avoid default passwords on collector service accounts in shared lab platforms.
Command guide
Try these commands — Pre-enum checklist (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Enum hygiene — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices (minimize lab noise) adsecurity.org — https://adsecurity.org/ (enum techniques named for detection) MITRE Discovery — https://attack.mitre.org/tactics/TA0007/ (discovery tactic literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/enum-hygiene.txt" <<'EOF'
lab enum hygiene:
- scope: LAB_AD_HOST / LAB_AD_DOMAIN only
- log your activity for purple-team notes
- no ldapdump/secretsdump against strangers
- revert lab snapshot after enum exercises
EOFCommand — copy this
grep -E 'scope|strangers|snapshot' "$LAB_AD/notes/enum-hygiene.txt"
python3 -c "print('Enum literacy: name tools, study detections — no stranger-domain ldapdump')"Primary tools to practice this lesson: grep, python3. Reference sites: Enum hygiene (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); adsecurity.org (https://adsecurity.org/); MITRE Discovery (https://attack.mitre.org/tactics/TA0007/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. During and after enum
Run only inside lab VLAN. Avoid parallel mass scans that disrupt shared GOAD instances for other students. Export to encrypted folder; delete on lab teardown.
When writing up findings, use fictionalized account names unless course permits real lab personas.
3. Defender detection literacy
Monitor 4662 (LDAP operations), 1644 (detailed LDAP on some builds), volume spikes, new service principal enumeration. Purple teams correlate their enum with SIEM to tune detections — inside $LAB_AD only.
Ship: enum hygiene checklist — ten items, pre/during/post. Next: Enum Lab.
4. What you ship: enum hygiene checklist for $LAB_AD
Ten-item pre/during/post enum checklist. $LAB_AD scope reference. NO stranger enum. chmod 600.
5. What you record before the next lesson
Date. Enum hygiene checklist. $LAB_AD named. File t25-m04-l03-enum-hygiene.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run default BloodHound ingest against production. Share unredacted LDAP dumps in chat.
Right
Write enum hygiene checklist for YOUR $LAB_AD practice. Next: Enum Lab.
Mission: freeze enum hygiene checklist
1) Write five pre-enum checks. 2) Write three post-enum storage rules. 3) Name one LDAP event defenders watch. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Shared GOAD instances need rate limits — be a good lab citizen.
Knowledge Check
APPLY: Enum hygiene means:
Multiple choice
Knowledge Check
APPLY: True or False: Enum outputs should be chmod 600 and deleted on lab teardown.
True or False
Knowledge Check
APPLY: Before enum you should:
Multiple choice