Active Directory foundations, rights, ACLs, Kerberos, NTLM, and Tier 0
Secure PDF2026 Fifth Edition · Revision 5.1
Active Directory Attack Paths
2026 Fifth Edition Revision 5.1 / Practitioner Edition
A practitioner field manual for authorized Active Directory assessment, attack-path validation, hybrid identity, detection, defense, and reporting.
400 pagesPractitioner editionSecure PDF delivery
Launch price$150
Read the Free SampleExplore Flightpath, the CherryTree operator companion — $19 add-on or $160 book + notebook bundle.
One-time purchase. Stripe-secured private download appears after payment and is also emailed to the purchaser.
Inside the Manual
Learn the path. Verify the evidence. Break the chain.
Built for defensive professionals, authorized assessors, instructors, administrators, and serious lab learners.
Scope, rules of engagement, reconnaissance, DNS, and authenticated enumeration
BloodHound, SharpHound, and PowerView verification workflows
Kerberoasting, AS-REP roasting, credential stores, hashes, and ticket concepts
GenericAll, GenericWrite, WriteDACL, WriteOwner, GPO, OU, and session paths
Windows LAPS, gMSA, delegation, AD CS, DCSync, trusts, and hybrid Entra identity
Detection engineering, evidence, reporting, remediation, and retesting
GOAD labs, screenshots, decision trees, case studies, and a scored capstone
Detection-event encyclopedia and printable operator field cards
Evidence-Driven
More than a command list.
The manual teaches attack-path reasoning, manual edge verification, least-invasive validation, defensible evidence, reporting language, and retest decisions.
Practitioner Ready
Designed for repeatable fieldwork.
Use sequential study, operator lookup, GOAD exercises, screenshot walkthroughs, detection references, field cards, case studies, and hybrid identity chain analysis.
New in the Fifth Edition
Clearer practitioner workflows and hybrid identity chains.
The Fifth Edition sharpens navigation and reader workflow with a clearer route into the material and corrected cross-references, alongside the full attack-path coverage: hybrid identity chains, structured validation, defensive interpretation, and practical reporting for authorized assessment work.
Preview the Style
Read a free sample.
This 16-page sample previews the manual's teaching style and foundational coverage. The paid product delivered after checkout is the full 400-page Fifth Edition (Revision 5.1), Practitioner Edition.
Included With Paid Scans
Get the Client Edition with a paid scan.
A plain-language client guide to exposed personal information, breached accounts, scams, safer passwords, privacy cleanup, and practical next steps.
$14.99 standalone—or included at no added cost with any paid one-time scan.
Responsible Use & License
Authorized training and assessment use only.
Commands and procedures are intended for intentionally vulnerable labs or systems covered by explicit written authorization. Purchase grants one customer a non-transferable license to use the PDF. Redistribution, resale, public posting, and removal of copyright notices are prohibited.