Advanced penetration testing simulates sophisticated adversaries using creative techniques to evade detection while achieving objectives. In 2026, the bar for red team capabilities has risen as defensive tools matured. This guide covers advanced techniques red teams use and blue teams must understand and defend against.
Red Team vs Penetration Test
A penetration test is scoped, time-limited, and focused on finding vulnerabilities. A red team operation simulates a realistic adversary pursuing a defined objective (access CFO email, exfiltrate customer data) using any available technique while attempting to avoid detection. Red team engagements measure the entire security program, not just technical vulnerabilities.
Active Directory Attack Techniques
Kerberoasting
Requests Kerberos service tickets for SPNs and cracks them offline. Any authenticated domain user can request service tickets. High-value targets: service accounts with weak passwords and SPNs for SQL Server, IIS, or custom applications. Mitigation: 25+ character passwords for all SPN accounts, deploy Group Managed Service Accounts (gMSA) with 240-character auto-rotating passwords.
AS-REP Roasting
Targets accounts with Do not require Kerberos preauthentication enabled. Allows anyone to request an AS-REP without authenticating, encrypted with the user password. Mitigation: audit and disable this flag, enable Kerberos pre-authentication requirement via Group Policy.
DCSync Attack
Abuses domain replication rights to extract password hashes from AD as if requesting replication from a DC. Requires Replicating Directory Changes and Replicating Directory Changes All rights. Mitigation: audit who has these rights with BloodHound. Only DCs and Azure AD Connect should have them.
Pass-the-Hash and Pass-the-Ticket
PtH uses stolen NTLM hashes to authenticate without knowing the plaintext password. PtT uses stolen Kerberos tickets. Mitigation: enable Credential Guard to block NTLM hash extraction from LSASS, enable Protected Users security group for privileged accounts, disable NTLM where possible.
LLMNR/NBT-NS Poisoning
When Windows fails DNS resolution, it broadcasts via LLMNR and NBT-NS. Responder answers these broadcasts and captures NTLM hashes from any device on the same segment. Mitigation: disable LLMNR via Group Policy (Turn Off Multicast Name Resolution = Enabled) and disable NBT-NS on all adapters.
C2 Frameworks
Modern red teams use Command and Control frameworks: Cobalt Strike (commercial, industry standard), Sliver (open-source), Brute Ratel C4, Mythic. Capabilities: process injection, token impersonation, pivoting, encrypted communications over HTTPS and DNS. Blue teams must deploy behavioral EDR that detects C2 beacon patterns even over encrypted HTTPS.
Defense Evasion
Sophisticated red teams use: process injection into legitimate processes (svchost.exe), Living off the Land (LOLBins) — abusing legitimate Windows tools (PowerShell, WMI, certutil), timestomping to modify file metadata, clearing event logs, disabling EDR sensors. Detection requires behavioral monitoring of LOLBin abuse patterns and PowerShell Script Block Logging.
🔗 Further Reading
FAQs
What is Kerberoasting?
Kerberoasting is an Active Directory attack where any authenticated domain user requests Kerberos service tickets for accounts with Service Principal Names (SPNs). The tickets are encrypted with the service account password hash and cracked offline. Mitigation: 25+ character passwords for all SPN accounts, Group Managed Service Accounts (gMSA).
How do I prevent LLMNR poisoning?
Disable LLMNR via Group Policy: Computer Configuration > Administrative Templates > Network > DNS Client > Turn Off Multicast Name Resolution = Enabled. Also disable NBT-NS on all network adapters. This prevents hash capture without requiring any credential knowledge from the attacker.
Key Takeaways
- Kerberoasting targets service accounts with SPNs — use gMSA with 240-character rotating passwords
- Disable LLMNR and NBT-NS via Group Policy to prevent trivial hash capture
- Credential Guard blocks NTLM hash extraction from LSASS
- C2 detection requires behavioral EDR — C2 traffic looks like normal HTTPS
- DCSync rights should exist only on domain controllers — audit and remove from all others
Conclusion
Advanced penetration testing in 2026 focuses on Active Directory attack paths, credential theft, and defense evasion. Deploy Credential Guard, disable LLMNR/NBT-NS, enforce gMSA, and run purple team exercises. Related: Penetration Testing Beginner Guide.
Sources
- MITRE ATT&CK Framework – attack.mitre.org
- BloodHound Documentation – github.com/BloodHoundAD/BloodHound
- Microsoft Security Documentation on Credential Protection – learn.microsoft.com
