What is ad-attack-defense?

The ad-attack-defense repository is a curated knowledge base focused on Active Directory security. Active Directory is the system that most large organizations use to manage user accounts, permissions, and computers on their network. This project serves as a comprehensive guide for understanding how hackers attack these networks and how defenders can protect them. The content is organized into stages that mirror a hacker's typical path, like discovery, privilege escalation, credential dumping, and lateral movement. Instead of containing software code, the README is essentially an organized list of links to external articles, tools, and videos. It walks through each phase of an attack, providing resources on specific tactics, such as the Zerologon vulnerability, password spraying, or exploiting domain trusts, along with guidance on how to mitigate and detect these threats. This resource is built for security professionals working in "red team" and "blue team" roles. A red teamer (or penetration tester) simulates real-world attacks to find an organization's weaknesses, while a blue teamer focuses on defense, detection, and incident response. For example, a red teamer might use the links under "Lateral Movement" to understand how to move from one compromised machine to another, while a blue teamer would study the same resources to figure out what alarms to set up to catch that activity. The project is notable for how it pairs offensive and defensive perspectives side by side. By covering the full "kill chain", the sequence of steps an attacker takes, it helps defenders think like attackers and vice versa. The README doesn't go into detail on every linked resource itself, but serves as a high-level map pointing to deeper technical content across the security community.