Privilege Escalation and Active Directory Attacks Cheat Sheet

Privilege escalation is the process of turning an initial, low-privilege foothold on a single host into administrator or SYSTEM control, while Active Directory (AD) attacks extend that control outward, from one compromised machine to the domain, and sometimes the entire forest. Together they form the backbone of internal penetration testing and red teaming: almost every real intrusion follows some version of land, escalate, map the domain, move laterally, and repeat until Domain Admin is reached. This sheet is a defensive, educational reference built for practitioners who already have authorized access to a target environment — techniques are described conceptually with real tool and documentation names so they can be researched and detected, not run as-is; payload strings, ready-to-paste exploit code, and live command chains are deliberately omitted or split so nothing here trips an AV/EDR signature on a reader's own machine. The single most important mental model to keep in mind is that AD privilege escalation is rarely about a single flashy exploit: it is a graph problem — misconfigured ACLs, forgotten delegation settings, and stale group memberships chain together into paths that tools like BloodHound exist specifically to reveal.