Active Directory and identity: attack paths and how to close them
Lesson 3 of 3
3Active Directory and identity: attack paths and how to close them
The big pictureActive Directory is the company's directory: every employee, device and permission. Most big ransomware incidents walk the same steps: one staff account through phishing, then a climb inside AD up to domain admin, then pushing encryption to every machine at once. A mid-level defender must know these steps by name, because each one leaves a trace that can be detected, and each path can be cut.
What the picture shows: A typical path through five stations. The defender does not need to stop them all; cutting any station breaks the path, and the earlier the better.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Picture a hotel. The domain controller is the front desk issuing room cards. Kerberos is the card system: you prove who you are once at the desk and get a general entry card (the TGT), then use it to ask for a card per room (a service ticket). A thief does not break doors; they steal a cleaner's card left in a manager's room, then find the owner's card in the manager's drawer. Tiering means the owner only ever leaves their card in their own secured office.
Kerberos: a user gets a TGT from the KDC on the domain controller (signed with the krbtgt account's key), then service tickets (TGS) encrypted with the service account's key. The attacks (ATT&CK): spraying T1110.003 (one common password across many accounts; detect: 4625/4771 from one source across many accounts), Kerberoasting T1558.003 (requesting tickets for SPN service accounts and cracking them offline; detect: 4769 with RC4 0x17 and many requests; prevent: gMSA or 25+ character passwords and AES only), pass-the-hash T1550.002 (prevent: LAPS, admins never signing in to ordinary machines, Credential Guard), DCSync T1003.006 (asking for password replication as if it were a domain controller; detect: 4662 with replication rights from a non-DC machine), and the golden ticket T1558.001 (after stealing krbtgt; cure: reset the krbtgt password twice). The structural defence: Microsoft's enterprise access model (tier zero for identity), PAW workstations, Windows LAPS, the Protected Users group, and turning off RC4 and NTLM where possible. BloodHound draws the paths as a graph. And in Entra ID: conditional access, PIM and phishing-resistant MFA.
Before You Start
🔑Identity and passwords
You know MFA and hashed password storage.
🧪Detection engineering
You know Windows events and Sigma rules.
The Core Idea
1Kerberos in a minute
When you sign in to your work PC in the morning, Windows asks the domain controller for a TGT, a ticket proving you are you for about ten hours. When you open a shared folder, Windows presents the TGT and asks for a service ticket for the file server, encrypted with that service account's key. This design means the krbtgt key is the key to the kingdom: whoever steals it can forge any ticket for anyone.
2The famous attacks: how to detect and stop them
You do not need to carry these attacks out to defend against them; you need to know their traces. Each has an event that reveals it and a setting that stops it:
| Attack | ATT&CK | What happens | Detection | Prevention |
|---|---|---|---|---|
| Password spraying | T1110.003 | One common password across hundreds of accounts | 4625 and 4771 from one source across many accounts | MFA, and banning common passwords |
| Kerberoasting | T1558.003 | Tickets for service accounts cracked offline | 4769 with RC4 (0x17) in bulk | gMSA, 25+ character passwords, AES only |
| Pass-the-hash | T1550.002 | Using the password hash instead of the password | 4624 type 3 over NTLM from unusual machines | LAPS, tiering, Credential Guard |
| DCSync | T1003.006 | Asking for password replication like a DC | 4662 with replication rights from a non-DC | Nobody but DCs holds replication rights |
| Golden ticket | T1558.001 | Forged tickets signed with krbtgt | Tickets with odd lifetimes or fields | Protect tier zero; reset krbtgt twice after an incident |
3Attack paths as a graph
An attacker thinks in graphs: "from this user, which machine can I get onto? Who is logged on to that machine? What are their rights?". BloodHound gathers those relationships and draws the shortest road to Domain Admins. A defender runs it before the attacker and cuts the dangerous edges. The same idea works in code:
Six hops from an HR employee to the whole domain, each one a forgotten admin habit. Cutting one edge breaks the whole path.
from collections import deque
edges = { # who/what -> what it gives access to, and why
"user:huda": [("host:HR-07", "local admin (old IT habit)")],
"host:HR-07": [("user:it-support", "session: it-support logged on here yesterday")],
"user:it-support": [("group:Server-Admins", "member")],
"group:Server-Admins": [("host:FILESRV-01", "local admin")],
"host:FILESRV-01": [("user:svc-backup", "service runs here")],
"user:svc-backup": [("group:Domain Admins", "member since 2015")],
}
def shortest_path(start, goal):
queue, seen = deque([(start, [])]), {start}
while queue:
node, path = queue.popleft()
if node == goal:
return path
for nxt, why in edges.get(node, []):
if nxt not in seen:
seen.add(nxt)
queue.append((nxt, path + [(node, nxt, why)]))
path = shortest_path("user:huda", "group:Domain Admins")
for a, b, why in path:
print(f"{a:<20} -> {b:<20} ({why})")
print(f"{len(path)} hops from a phished HR account to Domain Admins")
edges["user:svc-backup"] = [] # fix: svc-backup becomes a gMSA with no DA rights
print("after the fix:", shortest_path("user:huda", "group:Domain Admins"))4The structure that cuts the paths
Single fixes matter, but structure matters more. Tiering: tier zero (domain controllers and what manages them), tier one (servers), tier two (staff devices). A tier-zero account never signs in to a lower-tier machine, so its credentials are never left in a staff PC's memory. Alongside: Windows LAPS for a unique local admin password on every machine, Protected Users for privileged accounts, PIM for rights only when needed, and turning off RC4 and cutting NTLM.
Worked example
The task: the SIEM shows 300 events 4769 within two minutes from a sales employee's machine, all with encryption 0x17 and for different service accounts. What is happening? What do you do?
The answer: that is the Kerberoasting pattern: tickets requested in bulk for service accounts using weak RC4 to crack offline. (1) Isolate the machine and disable the employee's account for now. (2) Treat every service account whose ticket was requested as exposed: change their passwords at once, starting with the most privileged. (3) Look for 4624 for those accounts from unusual places after the event. (4) The lasting fix: gMSA, AES only, long passwords for whatever remains, and a Sigma rule on bulk 4769 with 0x17. (5) Run BloodHound to see which of those accounts was a road to Domain Admins.
Myth vs Reality
| Myth | Reality |
|---|---|
| Antivirus protects Active Directory. | Most AD attacks use built-in tools and real credentials, so there is no malicious file to catch. |
| A strong admin password is enough. | If the admin signs in to a compromised machine their credentials are stolen from memory however strong. Tiering matters more. |
| We moved to Entra ID in the cloud, so AD no longer matters. | Most companies are hybrid; compromising on-premises AD reaches the cloud through sync, and the other way round. |
Where you meet it at work
🚨Ransomware response
The first question: did the attacker reach tier zero? The answer sets the size of the recovery.
🔍Periodic review
BloodHound every quarter to cut new paths.
🏛️Compliance
The national controls require privileged access to be managed and separated.
Test your understanding
Whose key protects every Kerberos ticket in the domain?
TGTs are signed with the krbtgt key, which is why the golden ticket is forged from it.
Many 4769 events with encryption 0x17 from one machine. Which attack is likely?
0x17 is RC4, and bulk requests for service accounts are the mark of Kerberoasting.
What stops pass-the-hash between staff machines?
If machines share the local admin password, one hash opens them all.
After a breach that reached krbtgt, what do you do with its password?
The system keeps the previous password too, so a double reset invalidates forged tickets.
What is the core tiering rule?
That way privileged credentials are never left in the memory of a machine that can be broken.
Quick review cards
Check Your Understanding
Why does an attacker look for a path rather than a flaw?
Because forgotten rights and sessions give them what they want with the system's own tools, with no exploit to draw attention.
What is the point of running BloodHound yourself?
You see the shortest roads to Domain Admins before the attacker and cut their dangerous edges.
A 4662 event with replication rights from an accountant's PC. What does it mean?
Most likely DCSync: a non-DC machine asking to replicate passwords. A critical incident at once.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
reference3
Done with this lesson?
Sign in to save your progress.