Exploiting the Intruder’s Dilemma for Active Directory Defense

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

ESC1 abuses AD CS certificate templates with requester-supplied subject names and client-auth EKUs, letting an attacker get a certificate for any account, such as Domain Admin.

MFA fatigue (MFA bombing) floods users with push prompts until one is approved; Microsoft saw ~6,000 attempts a day by mid-2023. Covers the TTP, real examples, and defenses like number matching.

Kerberoasting explained: any authenticated user can request service tickets encrypted with weak RC4/DES service-account hashes and crack them offline. Covers Kerberos/SPN basics and defenses.

Man-in-the-middle primer: attackers position between communicating parties to intercept and alter traffic. Covers AD-relevant forms—NTLM relay, LDAP relay—impacts like credential theft, and defenses.

ITDR guide: explains what Identity Threat Detection and Response is, how it differs from EDR, why it matters for AD security, and how to evaluate solutions spanning before, during, and after attacks.