Active Directory Attack: techniques & vectors

An Active Directory attack targets the directory service Microsoft uses to manage authentication, authorization and trust relationships across Windows enterprise environments. Active Directory is a high-value target because compromising it grants control over every joined machine, user account and group policy object in the domain. Attackers exploit core protocols such as Kerberos, NTLM and LDAP to move laterally, escalate privileges and ultimately achieve domain dominance. Common attack classes include Kerberoasting, which requests service tickets for offline cracking of service account passwords; AS-REP Roasting against accounts with pre-authentication disabled; Pass-the-Hash and Pass-the-Ticket, which reuse captured credential material without knowing the cleartext password; and DCSync, which mimics domain controller replication to extract password hashes at scale. Misconfigurations in delegation settings, ACL permissions and Group Policy Objects further widen the attack surface. Understanding the exact mechanics of each technique is prerequisite knowledge for any SOC analyst or penetration tester operating in a Windows-centric environment.

Detecting Active Directory attacks relies on correlating Windows Security event logs with network telemetry and directory query activity. Event ID 4768 and 4769 signal Kerberos ticket requests; a spike in TGS requests for service accounts with RC4 encryption (etype 0x17) strongly indicates Kerberoasting. Event ID 4625 and 4771 cover failed authentication attempts useful for spotting password spraying. DCSync activity generates event ID 4662 with replication directory changes rights requested by a non-DC account, which is a high-fidelity indicator. LDAP reconnaissance tools such as BloodHound trigger large volumes of LDAP queries (event ID 1644 on domain controllers with LDAP diagnostic logging enabled). Monitoring for abnormal use of tools like Mimikatz involves watching for LSASS memory access (event ID 10 in Sysmon, targeting lsass.exe). A SIEM rule correlating privilege escalation paths, unusual AdminSDHolder modifications and new members added to Domain Admins (event ID 4728) provides early warning of domain takeover progression. Network-level detections should flag anomalous SMB lateral movement and unexpected replication traffic originating from non-DC hosts.

Red Team operators approach Active Directory attack chains in sequential phases. Initial access typically leverages phishing or a compromised workstation. From there, local credential dumping via Mimikatz sekurlsa::logonpasswords extracts NTLM hashes or Kerberos tickets cached in LSASS. BloodHound with SharpHound collector maps all ACL-based privilege escalation paths, identifying shortest paths to Domain Admins. Kerberoasting is executed with Rubeus kerberoast or Impacket GetUserSPNs.py, feeding hashes into Hashcat for offline cracking. Unconstrained delegation abuse allows capturing TGTs of any authenticating account, including domain controllers. The PrinterBug or PetitPotam coercion techniques force DC authentication to attacker-controlled systems. Once a domain controller hash is obtained, a DCSync attack via Mimikatz lsadump::dcsync extracts the krbtgt hash, enabling Golden Ticket forging for persistent, stealthy domain access. Hardening priorities include enforcing AES-only Kerberos, disabling NTLM where feasible, auditing all ACL delegations with tools like PingCastle, enabling Protected Users security group for privileged accounts and deploying Microsoft Defender for Identity to detect these attack patterns in real time.