Password Spraying Detection in Active Directory

Password spraying tries a few common passwords across many accounts to evade lockouts, targeting VPNs, Citrix gateways, and Entra ID tenants. Defenses include MFA and passwordless; DSP can detect it.

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled: attackers request an encrypted response and crack it offline. The post shows finding and fixing them with Purple Knight.

Semperis launched Lightning Identity Runtime Protection: ML-powered detection of proven identity attack patterns like password spray and brute force, layered on DSP and led by Igor Baikalov.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Password guessing attacks exploit default credentials, weak policies, and service accounts. The guide covers attack types, detection, and mitigation, including NIST-aligned guidance.

Unconstrained delegation lets a service impersonate users across the domain; attackers hunt such servers, capture Kerberos TGTs with Rubeus, and move laterally. Mechanics and remediation covered.