Detecting and Mitigating Active Directory Compromises | CISA
Summary: This joint international guidance provides an overview of 17 common techniques used to compromise Active Directory (AD DS, AD CS, and AD FS) and offers actionable security controls to detect and mitigate these threats.
Authored by the Australian Signals Directorate (ASD), CISA, NSA, and international partners, this document serves as a comprehensive guide for securing Active Directory environments. It addresses the inherent vulnerabilities of AD, such as permissive default settings and complex object relationships, which malicious actors exploit to escalate privileges, move laterally, and establish persistence. The guide details 17 specific attack vectors—including Kerberoasting, AS-REP Roasting, Golden Ticket attacks, and AD CS compromises—and provides technical mitigation strategies, such as implementing Microsoft’s Enterprise Access Model (Tiered model), enforcing AES encryption, and monitoring specific Event IDs. It emphasizes the importance of understanding object permissions and utilizing security tools like BloodHound and Purple Knight to harden the environment against both cybercriminals and nation-state actors.
Document outline
1. Introduction 2. Understanding Active Directory 3. Securing Privileged Access (Enterprise Access Model) 4. Technique 1: Kerberoasting 5. Technique 2: Authentication Server Response (AS-REP) Roasting 6. Technique 3: Password spraying 7. Technique 4: MachineAccountQuota compromise 8. Technique 5: Unconstrained delegation 9. Technique 6: Password in Group Policy Preferences (GPP) compromise 10. Technique 7: Active Directory Certificate Services (AD CS) compromise 11. Technique 8: Golden Certificate 12. Technique 9: DCSync 13. Technique 10: Dumping ntds.dit 14. Technique 11: Golden Ticket 15. Technique 12: Silver Ticket 16. Technique 13: Golden Security Assertion Markup Language (SAML) 17. Technique 14: Microsoft Entra Connect Compromise 18. Technique 15: One-way domain trust bypass 19. Technique 16: Security Identifier (SID) History compromise 20. Technique 17: Skeleton Key 21. Technique 18: Shadow Credentials 22. Detecting Active Directory compromises with canaries 23. Appendix A: Active Directory security controls 24. Appendix B: Active Directory events