Compromised Active Directory: attack paths

A compromised Active Directory environment means an attacker has gained persistent, privileged control over the AD domain infrastructure. Active Directory is the identity backbone of most enterprise Windows environments. It manages authentication, authorization, and Group Policy enforcement across all domain-joined assets. Compromised Active Directory typically results from chained exploitation: initial foothold, local privilege escalation, lateral movement, and finally domain privilege escalation. Attackers target AD because domain control grants access to virtually every resource in the organization. Key attack objectives include obtaining Domain Admin credentials, forging Kerberos tickets, or extracting the NTDS.dit database. The impact extends beyond a single host. One compromised domain controller can expose every user account, every service account, and every machine account in the forest. Understanding the exact mechanisms — credential relay, Kerberos delegation abuse, ACL misconfigurations — is essential to assessing the true blast radius of an AD compromise.

Detecting a compromised Active Directory environment requires monitoring domain controllers with high-fidelity log collection. Event ID 4768 and 4769 track Kerberos ticket requests. A spike in 4769 events with RC4 encryption type (0x17) indicates likely Kerberoasting activity. Event ID 4624 with logon type 3 combined with unusual source IPs signals lateral movement via pass-the-hash or pass-the-ticket. DCSync attacks generate Event ID 4662 with 'Replicating Directory Changes' rights exercised by non-DC accounts. Event ID 4728 and 4756 record additions to privileged groups such as Domain Admins or Enterprise Admins. LDAP enumeration leaves traces in Event ID 1644 on domain controllers when enabled. Tools like Microsoft Defender for Identity, Purple Knight, and BloodHound CE in audit mode help surface abnormal AD object relationships and delegation chains. Honeytoken accounts — fake privileged accounts with no legitimate use — trigger immediate alerts on any authentication attempt. Correlating these signals in a SIEM with baselines for normal replication traffic and admin logon patterns is critical to distinguishing real compromise from routine operations.

Red Team operators targeting a compromised Active Directory scenario follow structured attack chains. BloodHound with SharpHound collectors maps attack paths from low-privileged users to Domain Admin by enumerating ACLs, group memberships, and delegation settings. Kerberoasting — requesting TGS tickets for SPNs and cracking them offline with Hashcat — targets weak service account passwords. AS-REP Roasting exploits accounts with pre-authentication disabled. DCSync, executed via Mimikatz 'lsadump::dcsync', replicates domain controller credentials without touching the DC filesystem. Golden Ticket attacks forge TGTs using the KRBTGT account hash, granting persistent access even after password resets unless KRBTGT is rotated twice. Hardening countermeasures include implementing tiered administration models, enforcing Protected Users security group membership for all privileged accounts, disabling RC4 Kerberos encryption, auditing all accounts with unconstrained delegation, and deploying Microsoft LAPS for local admin password randomization. AD attack surface reduction must also include regular review of AdminSDHolder permissions and removal of stale privileged group memberships.