Executive summary
Board-level risk, domain-compromise timeline, finding distribution and urgent remediation sequence.
Complete redacted sample
Internal network pentest sample report
A complete customer-safe illustrative report showing how LunarChain Security documents Active Directory attack paths, lateral movement risk and business impact.
Findings snapshot
Critical
The sample starts from an assumed-breach internal position and shows multiple routes to domain compromise through identity, credential and lateral-movement weaknesses.
3 critical3 high2 medium
Key findings
- ADCS ESC1 certificate-template privilege escalation
- Kerberoastable privileged service account using weak password material
- LLMNR and NBT-NS poisoning with NTLM relay
- Delegation and tiering weaknesses exposing privileged authentication material
- Local administrator password reuse enabling broad lateral movement
Report structure
Scope and methodology
Network ranges, starting position, excluded systems, safety constraints and assumed-breach test method.
Attack narrative
A no-credentials-to-Domain-Admin chain that ties every escalation step to a remediable control gap.
Findings overview
Active Directory, credential, segmentation and legacy-protocol findings with ATT&CK mapping.
Remediation priorities
Immediate ADCS, Kerberos, NTLM, delegation and local-admin fixes ordered by blast-radius reduction.
Evidence handling
Redacted commands, affected systems, proof points and clean-up notes suitable for internal remediation tracking.
Methodology
Evidence built for engineers, auditors and leadership
Each sample is deliberately illustrative and customer-safe. The structure mirrors a live engagement: agreed scope, manual verification, evidence references, remediation guidance and retest-ready status tracking.
Book a callMethods and standards
PTESNIST SP 800-115MITRE ATT&CKActive Directory attack path analysis
Relevant services