Attack Paths Are Relationships
Active Directory security is mostly about relationships. A user, group, computer, service account, certificate template, GPO, OU, and trust object only becomes interesting when it connects to another object in a useful way. Attack path review is the process of turning those relationships into a clear route from current access to a defined objective.
I do not treat enumeration output as a flat list. I group data by identity rights, host access, delegation, credential exposure, administrative control, and protocol reachability. That makes it easier to find paths that are technically possible and operationally realistic.
ACLs And Ownership
ACLs are high-value because they can turn weak access into strong access without touching passwords. WriteDACL, WriteOwner, GenericAll, GenericWrite, validated SPN writes, group membership writes, and rights over GPO-related objects can all create movement paths.
The important detail is the target object and the practical action enabled by the right. WriteDACL over a low-value user may be limited. WriteDACL over a service account, privileged group, GPO, or delegation-related object can become a full chain. I map both the permission and the abuse primitive.
Delegation And Tickets
Kerberos delegation paths require careful review because the configuration can look harmless until combined with the right service principal and reachable protocol. Constrained delegation, resource-based constrained delegation, protocol transition, and service ticket substitution can create paths into systems that do not accept ordinary authentication from the current position.
When reviewing delegation, I track which account can delegate, which SPNs are allowed, whether protocol transition is enabled, which service is actually reachable, and whether alternative service use changes the practical access path. The key question is not only what is configured, but what can be requested and where it can be used.
GPO Control
GPO paths are powerful because they bridge directory permissions and host configuration. Create rights over policy containers, write rights over policy files, link rights over sites or OUs, and permissions to modify existing GPOs can become host control when the policy applies to valuable machines.
A good review separates LDAP control from SYSVOL control. Creating or linking the directory object is not enough if the policy files cannot be written correctly. Conversely, file write without a useful link may not affect any target. Both sides need to be understood.
Protocol Reachability
A valid identity path still needs a usable protocol. SMB, WinRM, WMI, MSSQL, LDAP, RDP, and HTTP management surfaces all have different authentication behavior, logging, firewall rules, and privilege requirements. I verify reachability before assuming an identity edge is operationally useful.
This is where attack path review becomes practical. A path that requires SMB may fail in an environment where SMB is blocked, while WinRM or MSSQL remains available. The route should reflect the actual network, not only the directory graph.