17 Active Directory Attack Techniques Highlighted by CISA

CISA and five international cybersecurity agencies have published new guidance outlining 17 techniques attackers can use to compromise Microsoft Active Directory environments.

The guidance explains how weaknesses in identity management, authentication protocols, certificate services, and privileged systems can help attackers gain higher access and move through an organization’s network.

The document was developed by the Australian Cyber Security Centre, together with CISA and the NSA, with contributions from cybersecurity agencies in Canada, the UK, and New Zealand.

It covers three major Active Directory areas:

• Active Directory Domain Services (AD DS)
• Active Directory Certificate Services (AD CS)
• Active Directory Federation Services (AD FS)

Active Directory is a high-value target because it manages authentication and access across many enterprise systems. A successful compromise can potentially give attackers access to accounts, workstations, servers, applications, email systems, and connected cloud services.

17 Techniques Attackers Use Against Active Directory

The guidance highlights several ways attackers can abuse authentication, permissions, certificates, and domain configurations:

1. Kerberoasting – Attackers request service tickets and attempt to crack them offline to recover service-account passwords.
2. AS-REP Roasting – Attackers target accounts without Kerberos pre-authentication and attempt to crack captured authentication responses.
3. Password Spraying – A small number of commonly used passwords are tested against many accounts to avoid triggering account lockouts.
4. MachineAccountQuota Abuse – Attackers use permissions that allow users to create computer accounts, which can later assist with privilege escalation or lateral movement.
5. Unconstrained Delegation – A compromised delegation-enabled system can expose Kerberos tickets belonging to privileged users.
6. Group Policy Preferences Password Theft – Old password information stored in SYSVOL can potentially be recovered and decrypted.
7. AD CS Abuse – Weak certificate configurations can allow attackers to obtain authentication certificates for other users, including privileged accounts.
8. Golden Certificate – Theft of a certificate authority’s private key can allow attackers to create trusted certificates and maintain access.
9. DCSync – Attackers with appropriate replication permissions can request password hashes from Active Directory, including the KRBTGT account hash.
10. NTDS.dit Theft – Stealing the Active Directory database can provide attackers with credential hashes that can be analyzed offline.
11. Golden Ticket – A stolen KRBTGT hash can be used to create forged Kerberos tickets with powerful domain privileges.
12. Silver Ticket – Stolen service or computer account credentials can be used to create forged tickets for specific services.
13. Golden SAML – Compromising AD FS signing credentials can allow attackers to create fraudulent authentication responses for federated services.
14. Microsoft Entra Connect Abuse – Attackers can target synchronization systems and privileged accounts connecting on-premises Active Directory with Microsoft Entra ID.
15. One-Way Domain Trust Abuse – Attackers can exploit trusted-domain information to obtain unauthorized access across domain boundaries.
16. SID History Abuse – A privileged SID can be added to another account, allowing it to inherit additional permissions.
17. Skeleton Key – Attackers modify authentication behavior on a domain controller so that a hidden password can work alongside legitimate passwords.

The guidance also discusses Shadow Credentials, where attackers add their own authentication key to an account. This can allow them to authenticate as the targeted user without changing the user’s password.

How Organizations Can Reduce the Risk

The agencies recommend treating key identity systems as Tier 0 assets, including domain controllers, certificate authorities, AD FS servers, and Entra Connect systems.

Organizations should focus on reducing unnecessary privileges and strengthening authentication controls.

Recommended measures include:

• Use phishing-resistant MFA for privileged accounts.
• Separate administrative accounts from normal user accounts.
• Use secure workstations for privileged administration.
• Remove unnecessary service principal names.
• Use group Managed Service Accounts where appropriate.
• Enforce Kerberos pre-authentication and stronger encryption.
• Set unnecessary machine-account creation permissions to zero.
• Remove unconstrained delegation where it is not required.
• Eliminate legacy passwords stored through Group Policy Preferences.
• Disable outdated protocols such as NTLM and SMBv1 where practical.
• Protect LSASS and other credential-handling components.

Organizations investigating a possible Active Directory compromise should also rotate sensitive credentials and review certificate configurations, SID History, and msDS-KeyCredentialLink changes.

Monitoring is equally important. Security teams should collect and analyze logs from domain controllers, certificate authorities, AD FS, and Entra Connect.

Important events to watch include:

• 4768 / 4769 – Unusual Kerberos authentication activity
• 4662 / 5712 – Possible directory replication activity
• 4741 – Unexpected computer-account creation
• 4886 / 4887 – Suspicious certificate requests
• 5136 – Changes to directory objects

Active Directory attacks can be difficult to spot because many techniques use legitimate protocols and administrative functions. Building normal authentication and administrative activity baselines can therefore help security teams identify unusual behavior earlier.

The new guidance reinforces a key security principle: protecting Active Directory means protecting the identity layer that connects users, systems, applications, and cloud services across the enterprise.

About the Author

FHN

Administrator

FirstHackersNews- Identifies Security

Visit Website View All Posts