Enumeration Drives The Path
Red team work is not about running every command available. It is about collecting enough context to choose the next useful action. Network exposure, identity relationships, service configuration, and reachable management paths usually decide the route.
I start by separating signal from noise. Which hosts matter? Which services expose identity or management surfaces? Which credentials are valid? Which accounts have meaningful relationships? Which paths are reachable from the current network position? The answers shape the operation.
I treat enumeration as a graph-building process. Hosts, users, groups, sessions, SPNs, shares, certificates, databases, linked servers, delegation settings, and local admin rights are not isolated facts. They become useful when they reveal a route from current access to a defined objective.
Identity Is The Center
In Windows and Active Directory environments, identity often matters more than host access. Kerberos tickets, delegated rights, group memberships, ACLs, GPO control, service accounts, certificates, and cached credentials can reveal paths that are quieter and more reliable than direct exploitation.
A useful workflow tracks the current principal, token context, ticket cache, protocol used, host access, and expected audit trail. This avoids confusion when moving between SMB, WinRM, MSSQL, LDAP, Kerberos, and remote management paths.
Advanced identity paths usually come from details: constrained delegation with protocol transition, resource-based constrained delegation, certificate mapping, shadow credentials, write rights over high-value groups, ownership changes, GPO link rights, or service principal manipulation. The operation becomes cleaner when those rights are understood before they are used.
Tradecraft Is Sequencing
The same technique can be noisy or controlled depending on sequencing. Requesting a ticket, changing an ACL, adding a group member, creating a service, or touching SYSVOL all leave different footprints. A mature workflow asks whether the action is necessary, whether a read-only alternative exists, and what evidence or rollback record should be kept.
Sequencing also reduces risk. Validate credentials before remote execution. Confirm host reachability before deploying a pivot. Enumerate delegation before requesting impersonation tickets. Confirm local admin rights before creating services. Each check prevents unnecessary actions and makes the final chain easier to explain.
Remote Execution With Context
Remote execution is strongest when paired with clear context: who the principal is, what host is targeted, what protocol is used, what logs are expected, and what cleanup is needed. Execution without context creates fragile access and poor evidence.
I prefer command paths that are explicit about authentication, transport, working directory, process context, and output. A clean remote command should answer what ran, where it ran, under which identity, and what result was observed.
Pivoting Without Losing Control
Pivoting should make access clearer, not more fragile. Stable proxy paths, explicit routes, documented assumptions, and known listener behavior matter. A pivot is useful only if it lets internal enumeration continue without losing track of where traffic is flowing.
The key is to maintain operational control. I track the pivot host, local listener, remote agent, allowed protocols, reachable subnets, and fallback plan. That prevents the internal phase from becoming a chain of temporary hacks that cannot be reproduced.
A good pivot also has a validation step. I want to prove that traffic is using the intended route, that DNS behavior is understood, that authentication still works through the path, and that the tunnel can survive enough time to finish enumeration. Without validation, pivoting creates false assumptions.
Evidence And Cleanup
Every useful operation produces evidence. That evidence can be command output, a ticket, a group relationship, a service configuration, a screenshot, a log entry, or a changed object. I keep evidence close to the action that produced it so the final narrative is defensible.
Cleanup is part of the workflow, not an afterthought. If an action creates a file, task, service, account, delegation entry, GPO change, or credential artifact, it should be tracked. Good notes make cleanup possible and make the assessment easier to review.