Documentation Index
Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt
Use this file to discover all available pages before exploring further.
invoke-userhunter is PywerView’s primary lateral movement reconnaissance command. It enumerates all computers in the domain via LDAP, then queries each host using get-netsession and get-netloggedon to discover where target users are currently logged in or have active sessions. By default it hunts for members of the Domain Admins group, but you can target any group, a specific username, or supply your own user list. Multi-threading significantly reduces enumeration time across large environments, and stealth mode limits queries to high-traffic servers (DFS, DCs, file servers) to reduce noise and detection risk.
Flags
Domain Controller Connection
IP address of the domain controller used to enumerate computers and users via LDAP.
Name of the domain to authenticate with.
Username for authentication.
Password associated with the specified username.
NTLM hashes for pass-the-hash authentication. Format:
[LMHASH:]NTHASH.Use Kerberos authentication. Reads credentials from the
KRB5CCNAME ccache file.Force a TLS connection to the domain controller.
Target Computer Selection
One or more specific hostnames or IPs to hunt against (space-separated). Skips LDAP computer enumeration when provided.
Path to a file containing hostnames or IPs to hunt against, one per line.
Custom LDAP filter applied when querying computers from the domain controller.
ADS path to use when searching for computers in LDAP (e.g., to restrict to a specific OU).
Only hunt against computers that have unconstrained Kerberos delegation enabled.
Domain to query for target machines. Defaults to the authenticating user’s domain.
Target User Selection
Name of a domain group whose members to hunt for. Defaults to
Domain Admins when no other user targeting flag is provided.Hunt for users who are effective local administrators on this specific server (resolved via
get-netlocalgroup).Hunt for a single specific username.
Custom LDAP filter applied when querying target users from the domain controller.
ADS path used when searching for target users in LDAP.
Path to a file containing usernames to hunt for, one per line.
Only target users where
adminCount=1 in Active Directory.Only target user accounts that are not marked as sensitive and not allowed for delegation.
Only return users whose domain does not match the searched domain (cross-domain sessions).
Hunt Behaviour
Number of parallel worker threads to use when querying target hosts. Default:
1.After finding a target session, attempt to verify whether the running user has local administrator access on the host where the session was found.
Only query commonly-used servers (DFS, domain controllers, and file servers) rather than all domain computers. Significantly reduces network noise.
Which server sources to query in stealth mode. Accepts one or more of:
dfs, dc, file. Default: all three.Stop hunting as soon as the first matching session is found.
Return all sessions found, regardless of whether they match a target user.
Logging verbosity sent to stderr. Choices:
CRITICAL (default), WARNING, DEBUG, ULTRA.Print results as JSON instead of the default human-readable format.