CISA and international cybersecurity agencies released new guidance about Active Directory attacks. The guidance describes common techniques hackers use against Microsoft identity environments. Active Directory remains a major target because it controls access across many business systems.
Attackers can use Active Directory weaknesses to steal credentials and expand network access. They may also use those weaknesses to maintain access after initial compromise. Some techniques can provide attackers with broad control across an organization.
CISA Identifies 17 Attack Techniques
CISA identified 17 common techniques used against Active Directory environments. These include Kerberoasting, password spraying, DCSync, Golden Tickets, and Silver Tickets. The guidance also covers Golden Certificates, Golden SAML, and Shadow Credentials. Other techniques target delegation settings, certificate services, domain trusts, and privileged accounts.
Many attacks abuse legitimate Active Directory features instead of exploiting software vulnerabilities. That makes malicious activity harder to separate from normal administrative activity. Attackers may use valid credentials, authentication tickets, certificates, or trusted system relationships.
Credential Attacks Remain a Major Risk
Password spraying targets many accounts using a small collection of likely passwords. Kerberoasting targets service accounts by requesting encrypted Kerberos service tickets. Attackers can attempt to crack those tickets offline and recover service credentials. DCSync can expose password hashes by abusing directory replication permissions.
Some attacks focus on maintaining access after defenders change passwords. Golden Tickets use a stolen KRBTGT hash to create fraudulent Kerberos tickets. Golden Certificates can let attackers create trusted authentication certificates. Shadow Credentials can add unauthorized authentication keys to Active Directory accounts.
Hybrid Environments Face Additional Risks
Hybrid environments also create additional risks between Active Directory and Microsoft Entra ID. Attackers may target Microsoft Entra Connect to move between local and cloud systems. A successful compromise can threaten Microsoft 365, Azure, and other connected services.
CISA Recommends Stronger Identity Security
CISA recommends stronger protections for critical identity systems and privileged administrative accounts. Domain controllers, certificate authorities, and Entra Connect servers require additional security controls. Organizations should limit privileged access and use secure administrative workstations. Phishing-resistant multifactor authentication can provide another important layer of protection.
Organizations should also review legacy protocols and unnecessary authentication settings. CISA recommends reducing NTLM use and disabling SMBv1 where possible. Kerberos pre-authentication should remain enabled for accounts whenever practical. Unconstrained delegation should also be removed where business requirements allow.
Monitoring Can Help Detect Attacks
Monitoring plays an important role because many attacks resemble legitimate activity. Organizations should centrally collect logs from critical Active Directory systems. Security teams can then identify unusual authentication patterns and directory changes. Important events can reveal password spraying, suspicious ticket activity, or unexpected account creation.
CISA also recommends monitoring certificate services and Microsoft Entra Connect activity. Unexpected certificate requests may indicate attempts to gain additional privileges. Suspicious directory changes can reveal persistence techniques such as Shadow Credentials. Organizations should establish normal authentication baselines for easier anomaly detection.
Businesses Should Review Active Directory Security
Active Directory security requires more than password policies and endpoint protection. Businesses should understand privileged accounts, service accounts, trusts, and authentication settings. They should also know which systems hold the highest levels of access.
CISA’s guidance provides detailed mitigation and detection recommendations for these attack techniques. Businesses can review the full guidance through CISA’s Active Directory security resource.
Proactive IT Monitoring
Continuous monitoring can help identify suspicious activity before attackers expand their access. Next Phase Tech Partners provides IT monitoring for Chicago businesses and their technology environments. Learn more about our IT monitoring services for Chicago businesses.
