Active Directory Attacks: 5 Common AD Attack Methods

Nearly half of Microsoft IR engagements found unsecure AD configurations; Mandiant says 9 in 10 attacks exploit AD. Covers recon via PowerView and BloodHound, key techniques, and hardening priorities.

A domain controller should do one thing: control the domain. Why ADDS belongs on a DC and which roles, tools, and apps to keep off it to shrink the attack surface.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Why Microsoft is retiring RC4 encryption to blunt Kerberoasting, which applications depend on it, and how to audit your AD environment to find RC4-dependent accounts before enforcement bites.

Pass the Hash lets attackers authenticate with stolen NT hashes instead of plaintext passwords, enabling stealthy lateral movement. The post shows the technique with Cobalt Strike and Mimikatz.

A Golden Ticket attack forges Kerberos TGTs using the KRBTGT hash, granting unrestricted domain access as any user. The post details creation in Cobalt Strike and defenses like tiered administration.