Active Directory: attacks & defense techniques

Active Directory (AD) is Microsoft's directory service used to manage authentication, authorization, and resource access across Windows domain environments. Active Directory stores user accounts, computer objects, group policies, and trust relationships in a hierarchical structure based on LDAP. At its core, AD relies on Kerberos for authentication and NTLM as a fallback protocol. The domain controller (DC) holds the authoritative copy of the AD database (NTDS.dit), making it the highest-value target in any Windows environment. Attackers who compromise a DC gain full control over every joined machine, every user credential, and every policy in the domain. Understanding AD's internal mechanics — how tickets are issued, how trusts propagate, how delegation works — is fundamental to both offensive security and defensive architecture. Forest and domain trust relationships extend the attack surface beyond a single domain boundary. Misconfigurations in ACLs, group memberships, Service Principal Names (SPNs), and delegation settings routinely create exploitable privilege escalation paths that are invisible to standard vulnerability scanners.

Detecting Active Directory attacks requires monitoring both the domain controller event logs and network traffic. Windows Event ID 4768 (TGT request) and 4769 (TGS request) are critical for identifying Kerberoasting attempts — a spike in RC4-encrypted TGS requests (etype 0x17) for multiple SPNs is a reliable indicator. DCSync attacks generate Event ID 4662 with the replication directory changes rights being exercised by a non-DC account. Event ID 4624 (logon) combined with logon type 3 and NTLM authentication can surface Pass-the-Hash attempts. BloodHound ingestion queries produce large volumes of LDAP traffic detectable via Zeek or network flow analysis. Tools like Microsoft Defender for Identity (MDI) and Elastic SIEM with Winlogbeat provide purpose-built AD threat detection. Monitoring changes to sensitive groups (Domain Admins, Enterprise Admins) via Event ID 4728 and 4732 is essential. Honeytoken accounts with no legitimate use can reliably detect credential spraying and lateral movement attempts across the domain.

Red Team operators target Active Directory through a well-documented kill chain. Initial enumeration relies on tools like BloodHound with SharpHound collectors to map ACL-based attack paths toward Domain Admin. Kerberoasting extracts service account TGS tickets offline for password cracking using hashcat with the krb5tgs module. AS-REP Roasting targets accounts with Kerberos pre-authentication disabled. DCSync, implemented in Mimikatz via lsadump::dcsync, replicates credential hashes directly from the domain controller without touching LSASS. Unconstrained delegation abuse allows capturing Kerberos tickets of any authenticating user, including domain controllers. Resource-Based Constrained Delegation (RBCD) attacks can lead to full host compromise with no special privileges required beyond write access to msDS-AllowedToActOnBehalfOfOtherIdentity. Hardening countermeasures include tiered administration models, Protected Users security group membership for privileged accounts, disabling NTLM where possible, enabling AES-only Kerberos encryption, and deploying Credential Guard to prevent in-memory credential extraction.