Enum Hygiene
Enum hygiene limits blast radius — scope, logging, rate, and data handling on $LAB_AD; defenders detect noisy LDAP.
Visual · t25_enum_hygiene
Enum hygiene literacy. $LAB_AD only. Original Cyberlium.
Noisy enum without scope is indistinguishable from attack — hygiene keeps YOUR lab work ethical and measurable.
Before any LDAP or graph collector on $LAB_AD: confirm RoE, snapshot VM, note start/end time, use dedicated lab account, throttle queries in shared ranges, store outputs chmod 600, redact if sharing screenshots. Defenders alert on mass LDAP binds, unusual service account enum, and off-hours BloodHound ingest patterns. Cyberlium documents enum hygiene checklist — not full enumeration cookbooks against stranger DCs. Next: Enum Lab.
1. Pre-enum checklist (named)
Verify $LAB_AD scope file signed or course-enrolled. Confirm DC IP in inventory. Snapshot. Dedicated low-priv lab user — not domain admin for routine enum literacy.
Log tool name and version; avoid default passwords on collector service accounts in shared lab platforms.
Command guide
Try these commands — Pre-enum checklist (named)
═══ WINDOWS / POWERSHELL (Lab Host) ═══
Discover Domain Controllers in current forest
Command — copy this
nltest /dclist:$env:USERDOMAIN
Enumerate domain admins and high-privilege groups
Command — copy this
net group "Domain Admins" /domain net group "Enterprise Admins" /domain
Query AD objects via LDAP filter
Command — copy this
Get-ADObject -LDAPFilter "(adminCount=1)" -Properties SamAccountName, distinguishedName
═══ LINUX / BASH (Lab Network) ═══ Query AD LDAP anonymously or with lab credentials
Command — copy this
ldapsearch -x -H ldap://${LAB_AD_HOST:-127.0.0.1} -b "dc=lab,dc=local" "(objectClass=organizationalPerson)" sAMAccountName 2>/dev/null | head -15Primary tools to practice this lesson: grep, python3. Reference sites: Enum hygiene (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); adsecurity.org (https://adsecurity.org/); MITRE Discovery (https://attack.mitre.org/tactics/TA0007/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. During and after enum
Run only inside lab VLAN. Avoid parallel mass scans that disrupt shared GOAD instances for other students. Export to encrypted folder; delete on lab teardown.
When writing up findings, use fictionalized account names unless course permits real lab personas.
3. Defender detection literacy
Monitor 4662 (LDAP operations), 1644 (detailed LDAP on some builds), volume spikes, new service principal enumeration. Purple teams correlate their enum with SIEM to tune detections — inside $LAB_AD only.
Ship: enum hygiene checklist — ten items, pre/during/post. Next: Enum Lab.
4. What you ship: enum hygiene checklist for $LAB_AD
Ten-item pre/during/post enum checklist. $LAB_AD scope reference. NO stranger enum. chmod 600.
5. What you record before the next lesson
Date. Enum hygiene checklist. $LAB_AD named. File t25-m04-l03-enum-hygiene.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run default BloodHound ingest against production. Share unredacted LDAP dumps in chat.
- Right: Write enum hygiene checklist for YOUR $LAB_AD practice. Next: Enum Lab.
Mission: freeze enum hygiene checklist
1) Write five pre-enum checks. 2) Write three post-enum storage rules. 3) Name one LDAP event defenders watch. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Shared GOAD instances need rate limits — be a good lab citizen.
APPLY: Enum hygiene means:
APPLY: True or False: Enum outputs should be chmod 600 and deleted on lab teardown.
APPLY: Before enum you should: