Active Directory Security Testing & Analysis Tools — Secure In Security

Secure In Security — Active Directory Security Testing & Analysis Tools Contact / About / Contact

Active Directory
Security Testing &
Analysis Tools

AD Security

By N. Craig

Introduction to Active Directory Security Testing

Microsoft Active Directory (AD) is the backbone of identity and access management in the majority of enterprise Windows environments. As the centralized repository for user accounts, computer accounts, group memberships, and Group Policy Objects, Active Directory is one of the most strategically valuable — and most heavily targeted — systems in any organization. A compromised Active Directory environment typically means total organizational compromise.

Active Directory security testing encompasses the processes, tools, and methodologies used to identify vulnerabilities, misconfigurations, and attack paths within an AD environment before adversaries exploit them. This document provides a comprehensive reference for the tools security professionals use to assess, audit, test, and monitor Active Directory security.

Key Concept

Active Directory security testing is a discipline that combines red team (offensive) techniques with blue team (defensive) analysis. Understanding how attackers enumerate and exploit AD is essential to building effective defenses.

Why Active Directory Is a Prime Target

Active Directory is targeted by virtually every sophisticated threat actor because it is the source of truth for authentication and authorization across Windows environments. Key reasons it is targeted include:

Single Point of CompromiseDomain Admin access provides control over every domain-joined system.
Legacy ArchitectureAD was designed in an era before Zero Trust — flat trust models and legacy protocols remain common.
ComplexityLarge AD environments accumulate misconfigurations, stale accounts, and excessive permissions over time.
Credential CachingWindows caches credentials in memory and on disk, creating numerous extraction opportunities.
Kerberos Attack SurfaceThe Kerberos authentication protocol introduces unique attack vectors such as ticket forgery and delegation abuse.

Scope of Active Directory Security Testing

Testing Domain	Description
Enumeration	Discovering users, groups, computers, GPOs, ACLs, and trust relationships without authentication or with low-privilege credentials
Privilege Escalation	Identifying paths from standard user to privileged accounts (Domain Admin, Enterprise Admin)
Lateral Movement	Moving between systems using stolen or forged credentials without triggering alerts
Persistence	Establishing footholds that survive credential resets and policy changes (Golden Tickets, AdminSDHolder abuse)
Credential Attacks	Extracting, cracking, or replaying credential material from memory, disk, and the network
ACL & Permission Abuse	Exploiting misconfigured access control lists to modify AD objects without administrator privileges
Trust Exploitation	Leveraging forest and domain trusts to move laterally across boundaries
Detection Evasion	Assessing whether malicious AD activity triggers SIEM alerts and EDR detections

Native Windows and Active Directory Diagnostic Tools

Microsoft provides a rich set of built-in tools for querying, auditing, and diagnosing Active Directory. Security professionals routinely use these tools during assessments because they are present on every Windows system, generate less suspicious traffic than third-party tools, and reflect exactly how administrators interact with the environment.

Command-Line AD Query Tools

Tool	Security Testing Use Case
dsquery	Enumerates AD objects (users, computers, groups, OUs) via LDAP. Useful for initial enumeration with limited privileges. Example: `dsquery user -name * -limit 1000`
dsget	Retrieves detailed attributes of AD objects. Often chained with dsquery to extract group memberships and account properties.
nltest	Tests and troubleshoots Netlogon service, discovers domain controllers, enumerates domain trusts. Example: `nltest /dclist:<domain>` and `nltest /domain_trusts`
net user / net group	Enumerates local and domain user accounts, group memberships. Simplest enumeration technique and frequently seen in initial reconnaissance.
whoami /all	Displays current user context, SID, group memberships, and privileges. Essential first step when establishing foothold on a system.
gpresult	Shows applied Group Policy Objects and their settings. Reveals security configurations, logon scripts, and software deployment policies.
ldifde / csvde	Export AD objects to LDIF or CSV format. Can dump large amounts of directory data when run with appropriate permissions.
klist	Displays Kerberos ticket cache. Used to verify ticket acquisition and diagnose credential reuse opportunities.
wmic	Windows Management Instrumentation CLI. Queries system information, running processes, and configurations across local and remote systems.

PowerShell Active Directory Module

The Active Directory PowerShell module (RSAT-AD-PowerShell) provides the most comprehensive native enumeration capability. When loaded by an attacker with standard user credentials, it exposes the full AD schema through cmdlets that closely mirror LDAP queries.

Cmdlet	Security Relevance
Get-ADUser -Filter * -Properties *	Dumps all user attributes including password policies, last logon dates, SPNs (Kerberoastable accounts), and AdminCount flag
Get-ADGroup -Filter * \| Get-ADGroupMember	Enumerates all groups and their members — identifies over-privileged accounts and nested group structures
Get-ADComputer -Filter * -Properties *	Lists all computer objects with OS versions — identifies legacy systems and potential lateral movement targets
Get-ADDomainController -Filter *	Identifies all domain controllers including read-only DCs (RODCs)
Get-ADTrust -Filter *	Enumerates all trust relationships — external, forest, shortcut, and realm trusts
Get-ADObject -LDAPFilter	Raw LDAP query capability for finding objects with specific attributes such as unconstrained delegation
Get-ACL “AD:…”	Retrieves ACLs on AD objects — used to identify WriteDACL, GenericAll, and other dangerous permissions
Get-GPO -All	Lists all Group Policy Objects. Combined with Get-GPOReport reveals security configurations and logon scripts.

Key Concept

Many PowerShell AD cmdlets require domain credentials but not elevated privileges. A standard domain user account can enumerate the vast majority of the AD directory, which is by design — and by an attacker’s advantage.

Windows Event Log Security Auditing

Windows Event Logs are the primary source of AD security telemetry. Security assessors review event log configuration to determine whether critical events are being captured and forwarded to a SIEM.

Event ID	Security Significance
4624 / 4625	Successful and failed logon events. High volumes of 4625 events indicate brute force or password spray activity.
4648	Logon using explicit credentials — key indicator of lateral movement using Pass-the-Hash or credential reuse.
4662	An operation was performed on an AD object — monitors for DCSync (replication request from non-DC) and AdminSDHolder writes.
4663	An attempt was made to access an object — file/registry access auditing for sensitive paths such as NTDS.dit staging.
4720 / 4722 / 4726	User account created, enabled, or deleted — baseline monitoring for unauthorized account creation.
4728 / 4732 / 4756	Member added to security-enabled group — critical for detecting privilege escalation through group membership.
4769	Kerberos Service Ticket request — used to detect Kerberoasting (RC4_HMAC_MD5 encryption type requests for service accounts).
4771	Kerberos pre-authentication failed — a burst of these across many accounts can indicate password spraying or guessing against Kerberos. (AS-REP Roasting does not generate 4771; detect it with 4768 — see below.)
4776	NTLM authentication attempt — detects NTLM relay setup and pass-the-hash activity.
7045	New service installed — persistence via malicious service installation on domain controllers.

Open-Source Active Directory Security Testing Tools

The open-source community has produced a suite of highly capable Active Directory security testing tools that are used extensively by penetration testers, red teams, and security assessors. These tools have also been widely adopted by threat actors, making them essential reference points for both offensive assessment and defensive detection.

BloodHound & SharpHound — Attack Path Mapping

BloodHound (developed by SpecterOps) is the most widely used Active Directory attack path analysis tool. It uses graph theory to map complex attack paths that are invisible to traditional security reviews. BloodHound visualizes AD relationships as a graph and identifies the shortest paths to Domain Admin from any starting point.

Component	Description
SharpHound (C# Collector)	The data collection agent that runs on domain-joined Windows systems. Performs LDAP queries and SMB enumeration to collect users, groups, computers, sessions, ACLs, and GPO data.
BloodHound GUI (Neo4j)	Graph database interface that renders relationships as nodes and edges. Supports Cypher query language for custom attack path analysis.
AzureHound	Extension of BloodHound for Azure Active Directory and Microsoft 365. Maps Azure RBAC, Conditional Access, and service principal relationships.
BloodHound CE (Community Edition)	Modern REST API-based architecture replacing the legacy Neo4j desktop application. Supports multi-tenancy and collaborative analysis.
Pre-Built Queries	Includes queries such as “Find Shortest Path to Domain Admins,” “Find All Domain Admin Sessions,” and “Find Kerberoastable Users with DA Path.”

Key Concept

BloodHound does not perform any exploitation — it only collects and analyzes data. A BloodHound assessment often reveals attack paths that exist purely because of accumulated permission assignments that appear reasonable in isolation but are dangerous in combination.

Impacket — Python AD Protocol Suite

Impacket (by SecureAuth/Fortra) is a Python library implementing a wide range of Windows and Active Directory network protocols. It provides reference implementations for SMB, LDAP, Kerberos, MSRPC, and DCERPC — the core protocols underlying Active Directory authentication and authorization.

Impacket Script	Function & Use Case
secretsdump.py	Remotely dumps NTLM hashes and Kerberos keys from domain controllers via DCSync (DRSUAPI) replication or locally from NTDS.dit and SYSTEM hive. Core post-exploitation tool.
GetUserSPNs.py	Enumerates Kerberoastable service accounts — accounts with SPNs. Requests RC4-encrypted TGS tickets that can be cracked offline.
GetNPUsers.py	Identifies accounts with pre-authentication disabled (AS-REP Roasting). Obtains encrypted AS-REP responses for offline password cracking.
psexec.py	Authenticates to remote systems using NTLM credentials and spawns an interactive shell via SMB. Widely used for lateral movement validation.
wmiexec.py	WMI-based remote command execution. Leaves a smaller forensic footprint than psexec as it does not write service binaries to disk.
ntlmrelayx.py	NTLM relay attack tool. Relays captured NTLM authentication attempts to target systems, domains, or LDAP servers for privilege escalation.
ticketer.py	Generates Kerberos Golden and Silver Tickets given a krbtgt hash or service account hash. Used to validate persistence technique coverage.
ldapdomaindump.py	Comprehensive LDAP enumeration that exports domain users, groups, computers, policies, and trusts to HTML, JSON, and CSV reports.

CrackMapExec (CME) & NetExec — Network-Wide Assessment

CrackMapExec (CME), now continued as NetExec, is a Swiss-army knife for assessing the security posture of large Windows/AD environments. It validates credentials against multiple protocols simultaneously and supports modules for enumeration, code execution, and data extraction.

Capability	Testing Use Case
SMB Authentication Testing	Tests domain credentials against all discovered hosts simultaneously — identifies password reuse and default credentials across the enterprise.
LSA Secrets & SAM Dumping	Extracts local SAM database hashes and LSA secrets from remote hosts when local administrator credentials are available.
BloodHound Data Collection	Integrated BloodHound collection module that gathers session, ACL, and membership data without deploying a separate collector binary.
Pass-the-Hash Testing	Authenticates using NTLM hash values directly, validating hash reuse across the environment and lateral movement paths.
LDAP Enumeration	Enumerates password policies, domain users, Kerberoastable accounts, and AS-REP-roastable accounts from any domain-joined host.
Module Ecosystem	Over 50 built-in modules covering credential extraction, enumeration, exploitation, and detection evasion validation.

Rubeus — Kerberos Attack Toolkit

Rubeus (developed by Will Schroeder / SpecterOps) is a C# toolset for raw Kerberos interaction and abuses. It operates entirely in memory and interacts directly with the Windows Kerberos API, making it effective for offensive Kerberos operations.

Rubeus Command	Attack Technique
kerberoast	Requests TGS tickets for all SPN-configured service accounts. Outputs tickets in hashcat/JtR compatible format for offline cracking.
asreproast	Harvests AS-REP responses for accounts with pre-authentication disabled. Requires no credentials when targeting pre-auth disabled accounts.
harvest	Monitors and extracts Kerberos tickets from LSASS memory in real time. Captures tickets as they are used by legitimate users.
ptt (Pass-the-Ticket)	Imports a Kerberos ticket into the current logon session — enables impersonation without extracting NTLM credentials.
golden	Creates a Golden Ticket — a forged TGT using the krbtgt account hash. Valid for any user, including non-existent ones, for 10 years by default.
silver	Creates a Silver Ticket — a forged TGS using a service account hash. Bypasses the KDC and grants access to a specific service.
s4u	Performs S4U2Self and S4U2Proxy extension abuses for constrained/unconstrained delegation attacks.
asktgt / asktgs	Requests TGTs and TGS tickets for any user (with their credentials or hash). Tests whether expected tickets are obtainable.

Important

Rubeus directly manipulates Kerberos tickets in memory and can disrupt live authentication sessions if used improperly. Always test in an isolated environment or obtain explicit written authorization before deploying in a production AD environment.

Mimikatz — Credential Extraction

Mimikatz (by Benjamin Delpy) is the most influential credential extraction tool in the history of Windows security. Originally developed as a proof-of-concept for Windows authentication vulnerabilities, it remains the reference implementation for techniques that every defender must understand and detect.

Mimikatz Module	Credential Extraction Technique
sekurlsa::logonpasswords	Extracts plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS process memory. Requires SYSTEM/Debug privileges or SeDebugPrivilege.
lsadump::dcsync	Simulates a DC replication request to extract any account’s NTLM hash and Kerberos keys from a live domain controller. Does not touch disk.
lsadump::sam	Extracts local SAM database hashes from the registry or offline SAM/SYSTEM hive files.
lsadump::lsa /patch	Patches the LSA to extract cached credentials (DCC2 hashes) for domain accounts that have logged on to the machine.
kerberos::golden	Creates Golden Tickets using the krbtgt account hash. Functions identically to Rubeus golden ticket generation.
kerberos::ptt	Injects Kerberos tickets into the current logon session for impersonation.
crypto::certificates	Enumerates and exports certificates and private keys from the Windows certificate store — relevant for ADCS abuse scenarios.
misc::memssp	Injects a malicious Security Support Provider into LSASS that logs all cleartext credentials to disk — persistence technique.

PowerView — AD LDAP Enumeration

PowerView (by Will Schroeder, part of PowerSploit) is a PowerShell-based AD enumeration library that provides extensive reconnaissance capabilities through standard LDAP queries. It remains one of the most comprehensive AD enumeration frameworks available.

PowerView Function	Enumeration Capability
Get-DomainUser -SPN	Finds all Kerberoastable users (accounts with service principal names). Can specify -unconstrained to find unconstrained delegation accounts.
Get-DomainGroupMember	Recursively resolves nested group memberships — identifies all effective members of privileged groups including Domain Admins.
Find-LocalAdminAccess	Checks all domain computers to identify which systems the current user has local admin access on. Identifies lateral movement opportunities.
Invoke-ACLScanner	Scans all domain object ACLs for dangerous permissions (GenericAll, WriteDACL, GenericWrite) granted to non-privileged users or groups.
Get-DomainGPO	Enumerates all GPOs and their linked OUs. Reveals security settings, logon scripts, and software installations.
Get-DomainTrust	Comprehensive trust enumeration including direction, transitivity, and trust type. Identifies cross-domain attack paths.
Get-DomainObjectACL	Returns ACL entries for AD objects. Combined with resolving SIDs reveals which accounts have write access to high-value objects.
Find-DomainUserLocation	Queries domain controllers for user logon sessions across all hosts — identifies where privileged users are currently logged in.

Kerbrute — Kerberos Username Enumeration

Kerbrute is a Go-based tool that uses Kerberos pre-authentication to enumerate valid domain usernames and perform password spray attacks without generating failed logon events (Event ID 4625) in the default Windows audit configuration.

Kerbrute Mode	Use Case
userenum	Tests a wordlist of usernames against the domain via AS-REQ. Valid usernames receive an error indicating pre-auth required; invalid ones receive PRINCIPAL_UNKNOWN.
passwordspray	Tests a single password against all discovered usernames. Avoids lockout by spacing requests. Does not log 4625 events unless full audit is enabled.
bruteuser	Targeted brute-force against a single account. Should only be used when account lockout policies have been confirmed as absent.
bruteforce	Username/password combination testing from a wordlist file. Used when credential pairs are known from external breaches.

Commercial and Enterprise Active Directory Security Tools

Commercial tools extend open-source capabilities with automated risk scoring, continuous monitoring, regulatory compliance mapping, and enterprise-scale deployment. They are essential for organizations that require ongoing AD security visibility beyond point-in-time penetration tests.

PingCastle — AD Risk Assessment

PingCastle is a widely used free-for-internal-use tool that provides rapid Active Directory risk assessment with a quantitative scoring model (0–100, lower is better). It generates comprehensive reports covering attack paths, privilege misconfigurations, and AD health indicators.

PingCastle Feature	Description
Risk Score (0–100)	Aggregated risk score based on domain-level findings. Broken into subcategories: Stale Objects, Privileged Accounts, Trusts, and Anomalies.
Attack Path Analysis	Identifies chains of vulnerable configurations that lead from low-privileged accounts to Domain Admin.
Health Check Report	HTML report covering 200+ security checks including ACL misconfigurations, delegation settings, and Kerberos ticket validity periods.
Comparison Reports	Tracks risk score changes over time, enabling measurement of security improvement initiatives.
Domain Cartography	Maps all domain trust relationships and highlights transitive trust chains across forest boundaries.
Compliance Mapping	Maps findings to ANSSI AD Security Guide, CIS Benchmarks, and MITRE ATT&CK framework controls.

Semperis Directory Services Protector (DSP)

Semperis DSP is an enterprise AD security and resilience platform that provides real-time monitoring of all Active Directory changes, automated rollback of unauthorized modifications, and forensic investigation capabilities. It is purpose-built for detecting and recovering from AD-targeted attacks.

DSP Capability	Security Function
Real-Time Change Monitoring	Captures every AD object modification, including changes that bypass standard auditing (direct database writes, replication changes).
Automatic Rollback	Reverses unauthorized changes to AD objects — including user permissions, group memberships, and GPO modifications — within seconds of detection.
Tier 0 Asset Protection	Monitors the most sensitive AD assets (Domain Admins, krbtgt, AdminSDHolder) with specialized alerting thresholds.
Forest Recovery	Facilitates rapid recovery from catastrophic AD attacks (ransomware, complete domain compromise) with malware-free backup restoration.
Attack Path Visualization	BloodHound-compatible attack path analysis integrated into the management console.
Azure AD Integration	Extends monitoring to hybrid Azure AD / Entra ID environments for unified identity security visibility.

Tenable Identity Exposure (formerly Alsid)

Tenable Identity Exposure (TIE) provides agentless, continuous Active Directory security monitoring with an attack indicator library mapped directly to MITRE ATT&CK. It analyzes replication traffic directly from domain controllers to detect attacks in real time.

TIE Feature	Description
Indicator of Attack (IOA) Library	100+ IOAs mapped to MITRE ATT&CK covering reconnaissance, credential access, lateral movement, and persistence techniques.
Agentless Architecture	Pulls AD replication data via DRSUAPI without deploying agents on domain controllers — minimal operational risk.
Exposure Score	Per-asset and domain-level security scoring that quantifies AD attack surface exposed to potential attackers.
Real-Time Attack Detection	Detects active attacks including DCSync, Golden Ticket use, Kerberoasting, and DCShadow within seconds of occurrence.
Attack Path Modeling	Identifies and ranks the most critical attack paths to privileged accounts based on current configuration.
Tenable Platform Integration	Integrates with Tenable.io and Tenable.sc for unified vulnerability management across AD and infrastructure.

Microsoft Entra ID Protection

Microsoft Entra ID Protection (formerly Azure AD Identity Protection) provides machine learning-based risk detection for both cloud and hybrid identity environments. It continuously evaluates sign-in risk and user risk to detect compromised accounts and anomalous authentication behavior.

Protection Feature	Security Capability
Sign-in Risk Detection	ML-based analysis of sign-in properties to detect anonymous IP use, impossible travel, password spray, and credential stuffing.
User Risk Assessment	Aggregates risk signals over time to assign user risk levels (Low/Medium/High) based on leaked credential databases and behavior anomalies.
Conditional Access Integration	Risk-based access policies that require MFA or block access when elevated sign-in or user risk is detected.
Risky Sign-in Reporting	Audit log of all risky sign-in events with investigation details for SOC analysis and remediation workflow.
Workload Identity Protection	Extends risk detection to service principals and managed identities — addresses non-human identity compromise vectors.
Microsoft Sentinel Integration	Exports risk events to Sentinel for correlation with other security signals in SIEM-based investigation workflows.

Key Active Directory Attack Techniques

Security assessors must thoroughly understand the attack techniques that Active Directory testing tools simulate and detect. The following techniques represent the most commonly observed and impactful AD attack vectors in real-world incidents.

Credential-Based Attacks

Technique	Mechanism	Primary Tools
Pass-the-Hash (PtH)	Authenticates to Windows systems using captured NTLM hashes without knowing the plaintext password. Exploits NTLM’s challenge-response design.	Mimikatz, CrackMapExec, Impacket psexec.py
Pass-the-Ticket (PtT)	Imports a stolen Kerberos ticket (TGT or TGS) into the current session to authenticate as the ticket’s owner without credentials.	Rubeus ptt, Mimikatz kerberos::ptt
Kerberoasting	Requests TGS tickets for SPN-configured service accounts encrypted with RC4. Cracks them offline to recover service account passwords.	Rubeus kerberoast, Impacket GetUserSPNs.py
AS-REP Roasting	Requests AS-REP responses for accounts with pre-authentication disabled. Encrypted data can be cracked offline without any domain credentials.	Rubeus asreproast, Impacket GetNPUsers.py
DCSync	Impersonates a domain controller replication partner to extract any account’s NTLM hash and Kerberos keys via DRSUAPI without touching disk.	Mimikatz lsadump::dcsync, Impacket secretsdump.py
LSASS Memory Dumping	Dumps the LSASS process memory to extract credentials of all users with active sessions on the compromised system.	Mimikatz, ProcDump, Task Manager, comsvcs.dll

Kerberos Ticket Forgery

Ticket Type	Technical Details & Impact
Golden Ticket	Forged TGT using the krbtgt account’s NTLM hash. Valid for any user in the domain (including non-existent accounts), for any service, for up to 10 years. Only mitigated by resetting krbtgt password twice.
Silver Ticket	Forged TGS using a service account’s NTLM hash. Grants access to a specific service without KDC involvement. Harder to detect as it bypasses the KDC entirely.
Diamond Ticket	Requests a legitimate TGT and modifies the PAC to add desired group memberships. More difficult to detect than Golden Tickets as it uses legitimate KDC-issued tickets.
Sapphire Ticket	Obtains a legitimate user’s ticket and replaces the PAC with another user’s PAC (from S4U2Self). Combines legitimacy of a real ticket with impersonation capability.

Important

Ticket forgery attacks remain valid until the krbtgt account password is reset twice (allowing both the current and previous password to expire). Organizations often underestimate this remediation requirement, leaving environments vulnerable even after detecting a Golden Ticket.

ACL & Delegation Abuse

Abuse Type	Attack Path Description
WriteDACL / WriteOwner	Account with WriteDACL rights on a high-value object can grant itself GenericAll access, enabling full control without any AD admin privileges.
GenericAll	Full control over an AD object — can reset passwords, modify group memberships, write service principal names, and modify ACLs. Often found on OUs or service accounts.
Unconstrained Delegation	Computers configured with unconstrained delegation store TGTs of any user that authenticates to them. Compromising these systems yields domain-wide credential access.
Constrained Delegation (S4U2Proxy)	Misconfigured constrained delegation allows a compromised service account to impersonate any user against target services.
Resource-Based Constrained Delegation (RBCD)	If an attacker can write the msDS-AllowedToActOnBehalfOfOtherIdentity attribute, they can configure RBCD to impersonate any domain user to the target computer.
AdminSDHolder Abuse	Modifying AdminSDHolder ACL propagates to all Protected Users via SDProp. Provides persistent backdoor access to Domain Admins and other protected accounts.

Active Directory Certificate Services (ADCS) Attacks

ADCS attack research (ESC1–ESC11 vulnerabilities, published by SpecterOps) revealed that misconfigured certificate templates represent a significant and frequently overlooked attack surface. The primary tool for ADCS enumeration is Certify (C# tool by SpecterOps).

ESC Vulnerability	Description
ESC1 — Template Enrollment	Vulnerable certificate templates allow any domain user to specify a Subject Alternative Name (SAN), enabling impersonation of any domain user including Domain Admin.
ESC2 — Any Purpose EKU	Certificate templates with Any Purpose or no Extended Key Usage allow the certificate to be used for authentication as any user.
ESC3 — Enrollment Agent	Certificate templates configured as enrollment agents allow a low-privileged user to request certificates on behalf of any domain user.
ESC4 — Vulnerable Template ACL	Low-privileged accounts have write access to certificate templates, allowing them to modify templates to introduce ESC1-type vulnerabilities.
ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2	CA flag that allows user-controlled SANs on all templates regardless of template configuration.
ESC8 — NTLM Relay to AD CS HTTP	Relaying NTLM authentication to the CA’s HTTP enrollment endpoint to obtain certificates for any authenticating account.

Assessment Frameworks and Security Hardening

Effective Active Directory security assessment follows structured frameworks that ensure comprehensive coverage and produce actionable, prioritized remediation guidance. The following frameworks and benchmarks serve as the authoritative references for AD security testing and hardening.

Microsoft Security Compliance Toolkit (SCT)

The Microsoft Security Compliance Toolkit provides pre-built Group Policy security baselines for Windows Server, Windows client OS, and Microsoft 365. Security assessors compare actual GPO configurations against these baselines to identify hardening gaps.

SCT Component	Function
Security Baselines (GPO)	Pre-configured GPO settings for Windows Server 2016/2019/2022, Windows 10/11, and Microsoft 365 Services. Represent Microsoft’s recommended minimum security posture.
Policy Analyzer	Compares current GPO settings against baseline files and generates a detailed deviation report. Identifies settings that are weaker than the baseline recommendation.
LGPO.exe	Command-line tool for applying and exporting local Group Policy settings. Used to apply baselines to standalone systems or validate policy application.
MSCT Baselines	Includes specific baselines for Domain Controller hardening, Member Server hardening, and Credential Guard configuration.

CIS Benchmarks for Active Directory

The Center for Internet Security (CIS) publishes consensus-based security configuration benchmarks. CIS Benchmark for Windows Server and CIS Benchmark for Microsoft Active Directory provide prescriptive hardening guidance for AD environments.

CIS Benchmark Area	Key Hardening Requirements
Account Policies	Password complexity, minimum length (14+ characters), lockout thresholds, and password history requirements enforced via Default Domain Policy.
Audit Policies	Advanced Audit Configuration requirements for Account Logon, Account Management, Privilege Use, and Object Access event categories.
User Rights Assignments	Restrictions on “Allow log on locally,” “Access this computer from the network,” and “Act as part of the operating system” on domain controllers.
Security Options	LAN Manager authentication level set to NTLMv2 only, SMB signing requirements, LDAP signing requirements, and Null Session restrictions.
Administrative Templates	Credential Guard enablement, LSASS protection settings, WDigest credential caching disabled, and PowerShell script block logging enabled.
Service Accounts	Managed Service Accounts (MSAs) and Group Managed Service Accounts (gMSAs) mandated for service accounts. Regular password rotation requirements.

MITRE ATT&CK for Active Directory

MITRE ATT&CK provides a comprehensive taxonomy of adversary tactics, techniques, and procedures (TTPs) observed in real-world attacks. The Windows and Identity matrix includes extensive coverage of Active Directory attack techniques, enabling assessment teams to structure their testing against a standardized framework.

ATT&CK Tactic	Relevant AD Techniques	Primary Detection Method
Reconnaissance (TA0043)	LDAP enumeration (T1069.002), Account Discovery (T1087.002)	LDAP query volume monitoring, Event ID 4625 patterns
Credential Access (TA0006)	Kerberoasting (T1558.003), AS-REP Roasting (T1558.004), DCSync (T1003.006), LSASS Memory (T1003.001)	Event ID 4769 (RC4 TGS), 4768 (Pre-Authentication Type 0), 4662 with DRSUAPI GUIDs
Lateral Movement (TA0008)	Pass-the-Hash (T1550.002), Pass-the-Ticket (T1550.003), Remote Services (T1021)	Event ID 4648, 4624 Type 3 with unusual source/destination
Persistence (TA0003)	Account Manipulation (T1098), Golden Ticket (T1558.001), AdminSDHolder (T1078.002)	Group membership changes (4728), new ACL entries on protected objects
Privilege Escalation (TA0004)	Token Impersonation (T1134), Domain Policy Modification (T1484)	Audit policy changes, GPO modifications (5136)
Defense Evasion (TA0005)	Indicator Removal (T1070), Trusted Developer Utilities (T1127)	PSScriptBlock logging (4104), AMSI bypass detection

Key Concept

Mapping assessment findings directly to MITRE ATT&CK technique IDs significantly increases the actionability of penetration test reports. IT and security teams can cross-reference detections in their SIEM, understand the adversary workflow, and prioritize remediations based on the full attack chain rather than isolated findings.

Tiered Administration Model

Microsoft’s Active Directory Tier Model (also known as the Administrative Tier Model or Enterprise Access Model) is the foundational architectural framework for AD privilege management. Security assessors evaluate whether organizations have implemented and maintained this model.

Tier	Scope & Enforcement
Tier 0 — Identity Control Plane	Domain Controllers, Active Directory itself, Azure AD Connect, ADFS. Tier 0 accounts must NEVER log on to Tier 1 or Tier 2 assets. Compromise of any Tier 0 system is equivalent to domain compromise.
Tier 1 — Server Administration	Application servers, databases, virtualization infrastructure. Tier 1 admins must not log on to Tier 2 workstations. Dedicated Privileged Access Workstations (PAWs) required.
Tier 2 — Workstation Administration	End-user workstations and devices. Help desk accounts with local admin rights on workstations. Cannot access Tier 0 or Tier 1 systems.
Privileged Access Workstations (PAWs)	Hardened dedicated workstations from which all Tier 0 and Tier 1 administration is performed. Isolated from internet, email, and standard workstation use cases.
Authentication Silos	Enforce tiered logon restrictions using Authentication Policy Silos — prevents Tier 0 credentials from being used on non-Tier 0 systems even if policy is bypassed.

Detection and Defensive Monitoring for Active Directory

Effective detection of Active Directory attacks requires correlation across multiple event sources, behavioral baselines, and honeypot mechanisms. The following practices represent the defensive monitoring strategies that security teams implement to detect the attacks described in this document.

Microsoft Defender for Identity (MDI)

Microsoft Defender for Identity (formerly Azure Advanced Threat Protection / Azure ATP) is Microsoft’s purpose-built AD threat detection product. It analyzes Kerberos, NTLM, LDAP, and ETW telemetry directly from domain controllers to detect known attack patterns in real time.

MDI Detection Category	Examples of Detected Techniques
Reconnaissance Detections	Account enumeration (netsession null session), LDAP enumeration, Network mapping reconnaissance, DNS reconnaissance via AXFR queries
Credential Access Detections	Kerberoasting, AS-REP Roasting, Golden Ticket use, Silver Ticket use, DCSync, NTLM relay, Brute force attacks
Lateral Movement Detections	Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, Remote code execution methods (PSExec, WMI, WinRM, Scheduled Tasks)
Privilege Escalation Detections	Honeytoken account access, Suspicious additions to privileged groups, Skeleton Key malware, Suspicious modification of sensitive attributes
Domain Dominance Detections	DCShadow, Suspicious replication requests, Malicious replication of directory services, Domain controller impersonation
Exfiltration Detections	Suspicious data transfer over DNS, Unusual LDAP queries exfiltrating bulk directory data

Detection Engineering — Key SIEM Rules

Building effective SIEM detection rules for Active Directory attacks requires understanding which event IDs, attributes, and combinations indicate malicious activity. The following rule patterns represent high-fidelity detections for common AD attacks.

Detection Rule	Logic & Tuning Notes
Kerberoasting Detection	Event 4769 where TicketOptions = 0x40810000 AND TicketEncryptionType = 0x17 (RC4_HMAC_MD5). Filter out known service accounts and batch requests. Alert on any request for an SPN ticket using RC4 encryption.
AS-REP Roasting Detection	Event 4768 (TGT requested) where Pre-Authentication Type = 0 (pre-auth not required), often with RC4 ticket encryption (0x17). Alert on any account requesting AS-REP without pre-auth — legitimate accounts should always use pre-auth.
DCSync Detection	Event 4662 where ObjectType matches DRSUAPI GUIDs: {1131f6ad-…} (DS-Replication-Get-Changes-All) AND source account is not a domain controller computer account.
Golden Ticket Detection	Event 4768 followed by 4769 where the TGT lifetime exceeds 10 hours, or the account name does not match any existing AD account. Requires enabling “Kerberos Service Ticket Operations” auditing.
Large LDAP Enumeration	Correlate LDAP search request counts per source host. Hosts performing >500 LDAP queries per minute that are not domain controllers or legitimate admin tools warrant investigation.
Suspicious Group Membership Change	Event 4728 / 4756 where the target group is a privileged group (Domain Admins, Schema Admins, Enterprise Admins, Group Policy Creator Owners). Alert on any addition regardless of source account.
AdminSDHolder Modification	Event 5136 (Object Modified) where the Object DN contains “CN=AdminSDHolder” — any modification to this object should trigger an immediate P1 alert.
Honeytoken Account Access	Create a dedicated AD account that is never used legitimately. Any authentication event (4624, 4625) or Kerberos ticket request (4768) for this account indicates active reconnaissance or credential spraying.

Key Concept

Honeypot accounts (honeytokens) and honeypot service principal names (Honey SPNs) are among the highest-fidelity detection mechanisms available. An attacker performing Kerberoasting will request tickets for all SPN-configured accounts — if one of those accounts is a honey SPN that no legitimate user ever accesses, the alert has near-zero false positive rate.

AD Security Assessment Summary & Remediation Priority

When completing an Active Directory security assessment, findings are typically prioritized according to their potential impact and ease of exploitation. The following framework provides a consistent approach to remediation prioritization.

Priority	Finding Category	Example Findings
Critical (P1)	Immediate domain compromise possible	Unconstrained delegation on non-DC, Kerberoastable Domain Admin service accounts, DCSync rights on non-DC accounts, ESC1 vulnerable certificate templates
High (P2)	Privileged escalation path identified	Tier 0 credential reuse on Tier 1/2 systems, GenericAll on Domain Admins group, Passwords in SYSVOL/GPP, AS-REP roastable accounts
Medium (P3)	Attack path component — requires chaining	Excessive LAPS read permissions, Writeable GPOs linked to Domain Controllers OU, Unconventional trust directions, Weak password policies
Low (P4)	Defense-in-depth improvement	Missing SMB signing on non-critical systems, NTLM v1 in use, Stale computer accounts, Overly broad “Authenticated Users” permissions
Informational	Visibility & monitoring gap	Missing audit subcategories, No SIEM alerting on 4662, Disabled Windows Event Forwarding, No MDI/Defender for Identity deployment

Important

Active Directory security assessments must be authorized in writing before commencing. Many of the tools described in this document — particularly Mimikatz, Impacket, and Rubeus — are detected by antivirus and EDR solutions and may trigger incident response procedures. Coordinate with the security team before deployment in any environment.