Active Directory attacks exploit trust relationships and legacy protocols. Defenders must monitor for attribute changes, isolate high-value accounts, and enforce strict delegation rules. Understanding how attackers move laterally through Kerberos and NTLM allows you to detect activity before data exfiltration occurs.
How do attackers initially compromise an Active Directory environment?
Attackers typically gain a foothold by compromising a single workstation or server with low privileges. They then use this access to harvest credentials from memory or local storage. This initial access is rarely the end goal but serves as the starting point for lateral movement. The attacker looks for paths to higher-privileged accounts using tools that exploit default configurations.
Why are service accounts a primary target for Kerberoasting?
Service accounts often have long-lived passwords and are rarely rotated, making them attractive targets. Kerberoasting exploits the Kerberos protocol by requesting service tickets for these accounts. The attacker captures the ticket and cracks the encryption offline. This method bypasses account lockout policies because the request appears legitimate to the domain controller.
What makes Golden Ticket attacks so difficult to detect?
A Golden Ticket is a forged Ticket Granting Ticket created using the hash of the KRBTGT account. This hash is the root key for the Kerberos authentication process. With this hash, an attacker can create tickets for any user, including administrators. Because the domain controller trusts its own key, it validates the forged ticket without external verification. This makes detection reliant on behavioral anomalies rather than authentication failures.
How does delegation misconfiguration enable privilege escalation?
Delegation allows a service to act on behalf of a user or another service. Misconfigurations in constrained or unconstrained delegation can allow an attacker to impersonate high-privileged accounts. If a service account has unconstrained delegation, an attacker can redirect authentication requests to a machine they control. This allows them to capture the TGS for domain administrators. See our guide on privilege escalation attacks for more on exploiting trust relationships.
Can attackers move laterally without using passwords?
Yes, attackers use pass-the-hash and pass-the-ticket techniques to move laterally. Pass-the-hash involves using the NTLM hash of a password instead of the plaintext password. Pass-the-ticket uses stolen Kerberos tickets. These methods allow movement without triggering password change policies or account lockouts. They rely on the fact that many protocols accept hashes as valid proof of identity.
| Attack Method | Credential Required | Detection Difficulty |
|---|---|---|
| Kerberoasting | Service Account TGT | Medium |
| Golden Ticket | KRBTGT Hash | High |
| Pass-the-Hash | NTLM Hash | Medium |
| DCSync | Replication Rights | Low |
See also: Warning Signs of Cyber Range Training Platforms in Production · DFIR Training Myths That Weaken Incident Response Capabilities
How do attackers maintain persistence after a breach?
Attackers create backdoor accounts or modify existing accounts to retain access. They may add themselves to privileged groups like Domain Admins. Another method is creating hidden users or renaming legitimate accounts to look like system processes. These changes often go unnoticed if monitoring focuses only on logon events. Attribute modifications are the key indicator of persistence.
Why is monitoring attribute changes more effective than monitoring logons?
Logon events are numerous and noisy, leading to alert fatigue. Attribute changes, such as modifying the msDS-AllowedToDelegateTo field, are rare and specific. Monitoring for these changes provides a clear signal of malicious activity. It allows defenders to see the preparation phase of an attack. This approach reduces noise and highlights the actual mechanism of the breach.
How can you limit the impact of a compromised domain controller?
Segmenting your network limits the blast radius of a compromised controller. Implementing a tiered administration model ensures that not all administrators have access to all systems. Using Privileged Access Workstations restricts where administrative tasks can be performed. This containment strategy prevents a single breach from compromising the entire forest.
What role do legacy protocols play in modern attacks?
Legacy protocols like NTLM and LDAP over plain text transmit credentials insecurely. Attackers exploit these protocols to capture hashes or plaintext passwords. Disabling these protocols forces the use of more secure alternatives like Kerberos and LDAPS. This reduces the attack surface and makes credential theft more difficult. See our guide on defense evasion for techniques attackers use to bypass protocol restrictions.
How do nation-state actors differ in their AD attacks?
Nation-state actors often use custom tools and slower, more stealthy techniques. They may spend months mapping the environment before acting. Their goal is often long-term access rather than immediate data theft. They exploit complex delegation chains and trust relationships. Understanding these advanced tactics helps in building deeper detection capabilities. Refer to our guide on nation-state cyber attacks for context on their operational security.
What is the most common mistake in AD security monitoring?
The most common mistake is focusing only on successful logons from known IPs. Attackers often use legitimate credentials and internal IPs. They also use legitimate tools for lateral movement. Monitoring for unusual process execution and attribute changes is more effective. This requires a baseline of normal behavior to identify deviations. See our guide on detection use cases for examples of effective monitoring strategies.
How do you recover from a compromised KRBTGT account?
Recovering from a compromised KRBTGT account requires resetting the password twice. The first reset invalidates existing tickets but leaves a window for attackers. The second reset, performed after 72 hours, ensures all old tickets are expired. This process disrupts authentication and must be planned carefully. It is a last-resort measure that requires significant coordination.
Why is regular auditing of group memberships critical?
Group memberships define access levels within Active Directory. Attackers often add themselves to privileged groups to gain control. Regular audits ensure that only authorized users have administrative rights. Automated tools can help track changes to these groups. This practice helps identify unauthorized access before it leads to a major breach.
How does beaconing relate to AD attacks?
Beaconing is the regular communication between a compromised host and a command-and-control server. Attackers use beacons to maintain control and receive instructions. Detecting beaconing patterns can reveal compromised hosts. This is particularly useful in identifying long-term persistence. See our guide on beaconing for techniques to identify these network patterns.
What is the role of bulletproof hosting in AD attacks?
Bulletproof hosting providers ignore abuse complaints, allowing attackers to host infrastructure. This infrastructure can be used to host phishing pages or command-and-control servers. While not directly an AD attack, it supports the initial access phase. Recognizing the role of such hosting helps in threat intelligence. Refer to our guide on bulletproof hosting for more on this support structure.
Key takeaways
- Kerberoasting targets service accounts without requiring initial compromise of the domain controller.
- Golden Ticket attacks rely on stealing the KRBTGT hash to forge any user identity.
- Delegation misconfigurations allow attackers to impersonate services even with low privileges.
Active Directory security requires monitoring attribute changes and restricting delegation. Implement tiered administration to limit the impact of any single compromise.
Frequently asked questions
How do I detect a Kerberoasting attack?
Look for high volumes of TGS requests for service accounts, especially from unusual workstations or at odd hours.
Can I disable NTLM without breaking my network?
You can disable NTLM, but you must first audit and update all applications and services to use Kerberos or other secure protocols.
What is the difference between pass-the-hash and pass-the-ticket?
Pass-the-hash uses the NTLM hash of a password, while pass-the-ticket uses a stolen Kerberos ticket for authentication.
How often should I audit Active Directory group memberships?
You should audit group memberships continuously using automated tools, with manual reviews at least quarterly.
How this guide was produced: written by the Vuln Post editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
