Active Directory Attack Techniques You Must Defend Against

Active Directory (AD) remains the backbone of enterprise identity management, with over 90% of Fortune 1000 companies relying on it for authentication and authorization. Unfortunately, this widespread adoption makes AD an attractive target for cybercriminals. Understanding the attack techniques used against Active Directory is crucial for building effective defenses and protecting your organization’s most sensitive assets.

This comprehensive guide explores the most common Active Directory attack techniques and provides practical strategies to defend against them. Whether you’re a system administrator, security analyst, or IT professional, you’ll gain actionable insights to strengthen your AD security posture.

Table of Contents

• Password Spraying Attacks
• Kerberoasting
• Pass-the-Hash Attacks
• Golden Ticket Attacks
• DCSync Attacks
• Lateral Movement Techniques
• Privilege Escalation Methods
• Essential Defense Strategies

Password Spraying Attacks

Password spraying is a low-and-slow attack technique where attackers attempt a few commonly used passwords against many user accounts. Unlike traditional brute-force attacks that target a single account with multiple passwords, password spraying distributes login attempts across numerous accounts to avoid triggering account lockout policies.

How It Works

Attackers typically use a list of usernames obtained through reconnaissance and attempt passwords like “Password123,” “Summer2024,” or the company name. They carefully space out attempts to remain under lockout thresholds, often waiting 30 minutes to an hour between attempts.

Defense Measures

Implement multi-factor authentication (MFA) across all user accounts, enforce strong password policies that ban common passwords, and monitor authentication logs for patterns indicating password spraying. Consider implementing SentryPC for comprehensive endpoint monitoring that can detect suspicious login patterns and user behavior anomalies.

Kerberoasting

Kerberoasting exploits the way Active Directory handles service accounts and Kerberos authentication. This attack allows any authenticated domain user to request service tickets for service accounts, then crack these tickets offline to retrieve plaintext passwords.

Technical Process

When a user requests access to a service, they receive a Ticket Granting Service (TGS) ticket encrypted with the service account’s password hash. Attackers can request these tickets for any Service Principal Name (SPN) in the domain, then use tools like Hashcat or John the Ripper to crack them offline.

Example command using Impacket’s GetUserSPNs.py:

python GetUserSPNs.py domain/user:password -dc-ip 10.10.10.10 -request

Defense Measures

Use strong, complex passwords (25+ characters) for service accounts, implement managed service accounts (gMSA) where possible, regularly audit SPNs in your environment, and monitor for unusual TGS ticket requests.

Pass-the-Hash Attacks

Pass-the-Hash (PtH) attacks allow attackers to authenticate to remote systems using the NTLM hash of a user’s password without needing the actual plaintext password. This technique is particularly dangerous because it bypasses traditional password security measures.

How Attackers Execute PtH

After compromising a system and extracting password hashes from memory or the SAM database using tools like Mimikatz, attackers can use these hashes to authenticate to other systems in the domain. The attack exploits NTLM authentication’s design, which accepts the hash directly.

Defense Measures

Disable NTLM authentication where possible and enforce Kerberos, implement Credential Guard on Windows 10/11 and Server 2016+, use Protected Users security group for privileged accounts, and ensure local administrator passwords are unique across systems using solutions like LAPS (Local Administrator Password Solution).

Golden Ticket Attacks

Golden Ticket attacks represent one of the most severe Active Directory compromises. By obtaining the KRBTGT account’s password hash, attackers can forge Kerberos Ticket Granting Tickets (TGTs) that grant them unlimited access to domain resources.

Attack Characteristics

A Golden Ticket provides complete domain dominance because the forged TGT can claim any privileges for any user. These tickets can remain valid for up to 10 years by default and are difficult to detect since they appear as legitimate Kerberos tickets.

Defense Measures

Reset the KRBTGT password twice annually (waiting 10 hours between resets), implement strict privileged access management, monitor for anomalous Kerberos ticket requests, and consider reducing the maximum lifetime for user tickets. When employees access your network remotely, ensure they use secure connections through services like NordVPN to protect authentication traffic from interception.

DCSync Attacks

DCSync attacks abuse legitimate domain controller replication functionality to extract password hashes and other sensitive data from Active Directory. Attackers with appropriate permissions can impersonate a domain controller and request password data for any account.

Technical Execution

Using tools like Mimikatz, attackers execute DCSync to request replication data:

lsadump::dcsync /domain:example.com /user:Administrator

This returns the NTLM hash and Kerberos keys for the specified account without ever touching the domain controller’s disk.

Defense Measures

Strictly limit accounts with replication permissions (Replicating Directory Changes and Replicating Directory Changes All), monitor replication requests from non-DC sources, implement advanced threat detection, and regularly audit accounts with dangerous permissions.

Lateral Movement Techniques

Once attackers establish an initial foothold, they use various lateral movement techniques to expand their access across the network. Common methods include Windows Management Instrumentation (WMI), PowerShell remoting, and Remote Desktop Protocol (RDP).

Common Lateral Movement Methods

Attackers frequently use PsExec for remote command execution, WMI for stealthy execution without creating new processes, and PowerShell for versatile post-exploitation activities. They may also abuse scheduled tasks or service creation for persistence and movement.

Defense Measures

Implement network segmentation to limit lateral movement paths, enforce least privilege access principles, disable unnecessary protocols and services, deploy endpoint detection and response (EDR) solutions, and monitor for unusual remote execution patterns.

Privilege Escalation Methods

Privilege escalation techniques allow attackers to elevate their access from standard user accounts to administrative or domain admin privileges. Common vectors include exploiting misconfigurations, abusing delegation rights, and leveraging vulnerable services.

Common Escalation Vectors

Attackers exploit excessive permissions on Group Policy Objects (GPOs), abuse unconstrained delegation, leverage misconfigured service permissions, and exploit vulnerable drivers or applications running with elevated privileges.

Defense Measures

Regularly audit and minimize accounts with administrative privileges, implement tiered administration models, disable unconstrained delegation, keep systems patched and updated, and use tools like BloodHound to identify and remediate attack paths.

Essential Defense Strategies

Defending against Active Directory attacks requires a comprehensive, layered approach combining technical controls, monitoring, and security awareness.

Implement Zero Trust Architecture

Adopt a zero trust model where every access request is verified regardless of source. This includes implementing conditional access policies, continuous authentication verification, and microsegmentation.

Enable Comprehensive Logging and Monitoring

Configure advanced audit policies to capture critical events, centralize logs in a SIEM solution, establish baseline behavior patterns, and create alerts for suspicious activities like Kerberoasting attempts or unusual authentication patterns.

Regular Security Assessments

Conduct periodic Active Directory security assessments using tools like PingCastle or Purple Knight to identify misconfigurations and vulnerabilities. Perform penetration testing to validate your defenses against real-world attack techniques.

Privileged Access Management

Implement a robust privileged access management (PAM) solution that includes time-limited administrative access, just-in-time privilege elevation, session recording and monitoring, and separate administrative accounts for privileged tasks.

User Education and Awareness

Train users to recognize phishing attempts and social engineering, enforce security awareness programs, and establish clear incident reporting procedures. Many Active Directory compromises begin with credential phishing.

Patch Management and Hardening

Maintain current patch levels for all systems, especially domain controllers, disable legacy protocols like NTLM v1 and SMBv1, implement LDAP signing and channel binding, and remove outdated systems from your environment.

Active Directory security is not a one-time configuration but an ongoing process requiring vigilance, regular assessment, and continuous improvement. By understanding these attack techniques and implementing robust defenses, you can significantly reduce your organization’s risk of AD compromise and protect your most critical authentication infrastructure.