CISA Warns of 17 Active Directory Attack Techniques

Key Takeaways

• Five international cybersecurity agencies, led by CISA, have issued comprehensive guidance detailing 17 common attack techniques targeting Microsoft Active Directory environments.
• The advisory covers exploits against Active Directory Domain Services, Certificate Services, and Federation Services, leveraging misconfigurations and legacy protocols.
• Attackers aim for privilege escalation, lateral movement, and persistent access by compromising identity configurations and privileged systems within enterprise networks.
• The guidance offers detailed detection methods and mitigation strategies, emphasizing the protection of critical “Tier 0” assets and the implementation of robust security controls.

A coalition of five global cybersecurity agencies, spearheaded by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), has unveiled an extensive technical guide outlining 17 prevalent methods threat actors employ to compromise Microsoft Active Directory (AD) environments. This collaborative effort provides deep insights into how adversaries exploit various facets of AD to gain unauthorized access, move stealthily across networks, and establish enduring footholds.

The detailed document explains that attackers frequently target identity configurations, outdated protocols, certificate services, and highly privileged systems. These vulnerabilities enable them to escalate privileges, traverse networks laterally, and maintain long-term presence within organizational infrastructures.

Originating from the Australian Signals Directorate’s Australian Cyber Security Center, the guidance saw significant contributions from CISA and the U.S. National Security Agency (NSA). Additional expertise was provided by the Canadian Center for Cyber Security, the UK National Cyber Security Center, and New Zealand’s National Cyber Security Center.

The advisory specifically addresses attack vectors against Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and Active Directory Federation Services (AD FS).

As detailed in the guidance published by CISA, Active Directory remains a prime target for malicious actors due to its central role in managing authentication and authorization across a vast array of enterprise systems. A successful breach of AD can grant attackers unfettered access to user accounts, workstations, servers, email systems, business applications, and integrated cloud services.

The participating agencies collectively warn that the intricate relationships between users, groups, and systems, coupled with permissive default settings and support for legacy protocols, create an expansive attack surface that many defenders find challenging to fully comprehend and secure.

17 Techniques Used by Hackers to Compromise Active Directory

The guidance meticulously details the following attack techniques:

1. Kerberoasting: Attackers request Kerberos service tickets for accounts with Service Principal Names (SPNs), then attempt offline brute-force cracking to expose service-account passwords.
2. AS-REP Roasting: Encrypted authentication responses are obtained for accounts that do not enforce Kerberos pre-authentication, subsequently cracked offline to reveal passwords.
3. Password Spraying: A small set of common or known compromised passwords are tried against a large number of accounts, aiming to avoid account lockouts while finding valid credentials.
4. MachineAccountQuota Compromise: An unprivileged user leverages the domain’s machine-account quota to create a computer object, then exploits its inherited permissions for lateral movement or privilege escalation.
5. Unconstrained Delegation: After compromising a computer configured for unconstrained delegation, attackers extract cached Ticket Granting Tickets (TGTs) from LSASS, potentially exposing credentials of highly privileged users.
6. Group Policy Preferences Password Compromise: Attackers scan SYSVOL for legacy Group Policy Preferences (GPP) cpassword values, which can be decrypted using a publicly known AES key.
7. AD CS Compromise: Misconfigured Active Directory Certificate Services templates or Certificate Authorities (CAs) allow attackers to request authentication certificates for other users, including domain administrators.
8. Golden Certificate: By stealing a CA’s certificate and private key, attackers can forge trusted certificates, impersonating users and maintaining persistent access.
9. DCSync: An attacker with directory-replication permissions mimics a domain controller to request password hashes, including the critical KRBTGT hash.
10. Dumping ntds.dit: Attackers copy the Active Directory database and SYSTEM registry hive from a domain controller or its backups, enabling offline extraction of domain credential hashes.
11. Golden Ticket: Using a compromised KRBTGT hash, attackers forge Kerberos Ticket Granting Tickets (TGTs), potentially granting themselves extensive domain privileges and long-term persistence.
12. Silver Ticket: Attackers utilize a stolen service-account or computer-account hash to forge Kerberos service tickets, gaining access to specific services without standard authentication.
13. Golden SAML: Theft of an AD FS token-signing certificate and private key allows attackers to forge SAML responses, impersonate users, and access federated services like Microsoft 365 or Azure.
14. Microsoft Entra Connect Compromise: Attackers target Password Hash Synchronization, Pass-Through Authentication, or highly privileged synchronization accounts to move between on-premises Active Directory and Microsoft Entra ID.
15. One-Way Domain Trust Bypass: After acquiring a trusted domain object password hash, attackers request Kerberos tickets from a different domain, circumventing the intended direction of a one-way trust.
16. SID History Compromise: Attackers add a privileged Security Identifier (SID) to an account’s sIDHistory attribute, allowing that account to inherit elevated permissions while obscuring the source of the access.
17. Skeleton Key: Attackers modify the LSASS authentication process on a domain controller, enabling a master password to work for multiple accounts while legitimate user passwords remain functional.

The guidance also specifically highlights “Shadow Credentials,” a technique where an attacker-controlled public key is added to an account’s msDS-KeyCredentialLink attribute. This enables certificate-based authentication as the victim without altering the account’s password, making unauthorized access significantly harder to detect through conventional password monitoring.

The agencies strongly advise treating domain controllers, certificate authorities, AD FS servers, and Entra Connect systems as “Tier 0 assets,” signifying their utmost importance and requiring the highest level of security.

What You Should Do

• Isolate Privileged Administration: Implement strict segmentation for privileged administrative accounts and systems.
• Deploy Phishing-Resistant MFA: Enforce phishing-resistant multi-factor authentication for all critical accounts.
• Utilize Secure Administrative Workstations: Mandate the use of dedicated, hardened administrative workstations for all AD management tasks.
• Minimize Delegated Permissions: Drastically reduce delegated permissions, adhering to the principle of least privilege.
• Remove Unnecessary SPNs: Regularly review and remove any unneeded Service Principal Names.
• Replace Conventional Service Accounts: Where possible, transition from conventional service accounts to Group Managed Service Accounts (gMSAs).
• Enforce Kerberos Pre-authentication and AES Encryption: Configure Kerberos to always require pre-authentication and enforce AES encryption.
• Set MS-DS-MachineAccountQuota to Zero: Configure the MS-DS-MachineAccountQuota attribute to zero to prevent unauthorized computer object creation.
• Eliminate Unconstrained Delegation: Disable unconstrained delegation wherever it is found.
• Remove Legacy Group Policy Passwords: Identify and remove any legacy passwords stored within Group Policy.
• Disable NTLM and SMBv1: Where feasible, disable NTLM and SMBv1 protocols.
• Protect LSASS: Implement robust protections for the Local Security Authority Subsystem Service (LSASS).
• Reset KRBTGT Twice: In the event of a suspected compromise, perform a double reset of the KRBTGT account password.
• Regularly Review Critical Attributes: Consistently audit certificate templates, SID History, and msDS-KeyCredentialLink modifications for anomalies.
• Centralized Log Monitoring: Establish centralized monitoring of logs from domain controllers, certificate authorities, AD FS, and Entra Connect for detection purposes. Pay attention to events like 4768 and 4769 for Kerberos activity, 4662 and 5712 for directory replication, 4741 for computer-account creation, 4886 and 4887 for certificate requests, and 5136 for suspicious directory-object changes.
• Baseline Normal Behavior: Develop a baseline of normal authentication patterns, as many AD attack techniques are designed to mimic legitimate administrative actions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.