CISA Details 17 Techniques Used by Attackers to Compromise Active Directory
CISA and international agencies have released a comprehensive guide outlining 17 common techniques threat actors exploit to compromise Microsoft Active Directory environments.
CISA, alongside five international cybersecurity agencies, has published detailed guidance exposing 17 prevalent techniques that malicious actors employ to compromise Microsoft Active Directory (AD) environments. This technical advisory aims to equip organizations with knowledge of how attackers exploit identity configurations, legacy protocols, certificate services, and privileged systems to escalate privileges, move laterally within networks, and establish persistent access.
The collaborative effort, spearheaded by Australia's ASD's ACSC and involving the US CISA and NSA, along with contributions from Canada, the UK, and New Zealand's national cybersecurity centers, scrutinizes attacks against Active Directory Domain Services, Certificate Services, and Federation Services. The agencies emphasize AD's critical role as the central hub for enterprise authentication and authorization, making it a prime target. A successful AD compromise can grant attackers access to a vast array of sensitive resources, including user accounts, servers, email, business applications, and cloud services.
The guidance highlights that permissive default configurations, the continued support for legacy protocols, and the intricate relationships between users, groups, and systems create a broad attack surface that can be challenging for defenders to fully comprehend and secure. The report details specific attack vectors such as Kerberoasting, where attackers attempt to crack service tickets offline to recover service account passwords, and AS-REP Roasting, which targets accounts not requiring Kerberos pre-authentication.
Other identified techniques include Password Spraying, where attackers test common passwords against multiple accounts to avoid detection; MachineAccountQuota Compromise, allowing unprivileged users to create computer objects for lateral movement; and Unconstrained Delegation abuse, where attackers leverage compromised delegation-enabled systems to extract credentials. The advisory also covers Group Policy Preferences Password Compromise, exploiting legacy cpassword values found in SYSVOL, and various attacks against Active Directory Certificate Services (AD CS), including misconfigurations that allow attackers to request fraudulent certificates.
Advanced techniques like Golden Certificate and Golden Ticket forging are also detailed, enabling attackers to impersonate users or gain extensive domain privileges by compromising certificate authorities or stealing the KRBTGT hash. The report further elaborates on Silver Ticket attacks, Golden SAML for impersonating users in federated services, and Microsoft Entra Connect Compromise, facilitating movement between on-premises AD and cloud environments.
Techniques like DCSync, which allows attackers to impersonate domain controllers to steal password hashes, and dumping the ntds.dit database, are also covered. The guidance warns about Skeleton Key attacks that modify the LSASS authentication process, and Shadow Credentials, which enable certificate-based authentication without altering user passwords, making detection more difficult.
To mitigate these threats, the agencies recommend treating domain controllers, certificate authorities, AD FS servers, and Entra Connect systems as Tier 0 assets. Key recommendations include isolating privileged administration, deploying phishing-resistant MFA, using secure administrative workstations, minimizing delegated permissions, removing unnecessary SPNs, and replacing conventional service accounts with Group Managed Service Accounts. Enforcement of Kerberos pre-authentication, AES encryption, disabling NTLM and SMBv1 where feasible, and protecting LSASS are also crucial steps.