ESC1 Attack Explained

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Attackers need only one weakness to break in but must stay hidden afterward. The post shows how to use that intruder's dilemma with decoys such as seemingly vulnerable AD CS certificate templates.

MFA fatigue (MFA bombing) floods users with push prompts until one is approved; Microsoft saw ~6,000 attempts a day by mid-2023. Covers the TTP, real examples, and defenses like number matching.

Kerberoasting explained: any authenticated user can request service tickets encrypted with weak RC4/DES service-account hashes and crack them offline. Covers Kerberos/SPN basics and defenses.

Man-in-the-middle primer: attackers position between communicating parties to intercept and alter traffic. Covers AD-relevant forms—NTLM relay, LDAP relay—impacts like credential theft, and defenses.