AD Domain ServicesArchitecture & Design

How to detect Golden Ticket attacks

November 14, 2025
How to Detect Golden Ticket Attacks in Active Directory A Golden Ticket attack is one of the most damaging post-compromise techniques in Active Directory: an attacker forges a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account secret, then impersonates any user (often Domain Admin) to access domain resources while blending into “normal”…
Read more
Automation & ToolingScripts & Templates

Detecting Kerberoasting with PowerShell and logs

November 14, 2025
Detecting Kerberoasting with PowerShell and Logs Kerberoasting is an Active Directory attack technique where an attacker requests Kerberos service tickets (TGS) for accounts that have Service Principal Names (SPNs), then cracks the ticket offline to recover the service account password. Because it uses legitimate Kerberos flows, the key to detection is understanding what…
Read more
AD Domain ServicesArchitecture & Design

Simulating AD attacks with Purple Team labs

November 14, 2025
Purple teaming in an Active Directory (AD) context is the discipline of running controlled, authorized attack simulations (red) while observing, tuning, and validating detection + response (blue). Done well, it turns vague goals like “improve AD security” into measurable outcomes: which attacks did we detect, how fast, with what signal quality, and what changed because of it. This guide…
Read more
Attack Techniques & Threat ModelingSecurity Operations for Identity

Using BloodHound to map privilege escalation

November 14, 2025
Using BloodHound to Map Privilege Escalation in Active Directory Privilege escalation in Active Directory (AD) rarely happens as a single “big misconfiguration.” It’s usually a chain: a little too much delegated access here, a leftover admin right there, an ACL that nobody remembers, and suddenly an attacker (or a red team) has a clean path to Domain Admin. …
Read more
AD Domain ServicesAuthentication & Protocols

Identifying unsecure SPN configurations

October 31, 2025
Identifying Insecure SPN Configurations in Active Directory (Detection + Fix Runbook) Service Principal Names (SPNs) are a core part of how Kerberos knows which service you’re trying to reach and which account should decrypt the service ticket. That also makes SPNs a high-signal control point for both security and reliability: weak service-account hygiene, legacy…
Read more
AD Domain ServicesArchitecture & Design

Detecting unauthorized domain replication

October 31, 2025
Unauthorized domain replication is one of the fastest ways for an attacker to turn “some access” into “total access.” If someone can trigger directory replication (or abuse replication rights) they can extract credential material (including password hashes) and move laterally at scale—often without noisy malware on domain controllers. What “unauthorized…
Read more
GPO FundamentalsGroup Policy & Endpoint Policy

Monitoring Group Policy for backdoors

October 31, 2025
Monitoring Group Policy for Backdoors (GPO Tampering Detection & Response) Group Policy is one of the most powerful configuration channels in Active Directory—and that’s exactly why attackers love it. If a threat actor gains the ability to edit a Group Policy Object (GPO) (or its SYSVOL content), they can push “legitimate” settings that…
Read more
Attack Techniques & Threat ModelingSecurity Operations for Identity

Detecting Pass-the-Hash attacks

October 31, 2025
Pass-the-Hash (PtH) is a credential abuse technique where an attacker uses a captured NTLM password hash to authenticate to other systems—without ever knowing the user’s plaintext password. In an Active Directory environment, PtH is primarily a lateral movement and privilege expansion tactic: once a usable hash is obtained (often from a workstation), the attacker pivots to servers, file…
Read more