opsec

How an adversary simulation really works, phase by phase: defining objectives, threat modelling, PRE-ATT&CK and ATT&CK, demonstrating impact, and delivering a report that speaks the language of the business.

Almost all Active Directory enumeration goes through LDAP (389/636), which is precisely the most watched channel in the domain. ADWS is a side door on port 9389 that accepts the same LDAP queries but is barely monitored. How it works under the hood, why its OPSEC is so good, and why it isn’t invisible.