Executive Summary
Active Directory (AD) remains a primary target for adversaries due to its central role in identity management. This technical briefing details the lifecycle of an AD compromise, from initial reconnaissance and credential harvesting via LLMNR/NBT-NS poisoning to advanced privilege escalation through Active Directory Certificate Services (AD CS) and Kerberos delegation.
The analysis highlights that modern attack chains often prioritize exploiting misconfigured templates (ESC1-8) and identity-based vulnerabilities like Certifried (CVE-2022-26923) and noPac (CVE-2021-42278/87). These methods allow attackers to bypass traditional password-based security and achieve full domain takeover (DCSync) by impersonating high-privileged accounts or Domain Controllers. Organizations are urged to audit their AD CS configurations and enforce SMB signing to mitigate these risks.
Key Details
Threat Name
Active Directory Exploitation
Affects
Windows, Active Directory Domain Controllers, Microsoft SMBv1 servers, Active Directory Certificate Services (AD CS), Active Directory
Adversary
—
MITRE Techniques
Malware/Tools
None identified