Active Directory Compromise: 17 Techniques to Hunt
Active Directory Compromise: 17 Techniques to Hunt | 2026
Executive Summary
CISA, NSA, ASD ACSC, the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK updated joint guidance on September 15, 2026 for detecting and mitigating Microsoft Active Directory compromises. The guide centers on 17 common compromise techniques affecting Active Directory Domain Services, Certificate Services and Federation Services, including Kerberoasting, AS-REP roasting and password spraying. So what? For defenders, this is not a generic hardening memo; it is a practical hunt plan for the identity layer attackers use to turn one foothold into domain-wide control.
The dominant reader action is to review identity telemetry, reduce privileged attack paths and validate whether common Active Directory abuse patterns are already present.
What happened?
- September 15, 2026: CISA listed a revised version of the joint resource "Detecting and Mitigating Active Directory Compromises."
- The guidance is co-authored with Five Eyes cyber agencies and focuses on common ways malicious actors compromise Active Directory environments.
- The resource covers 17 compromise techniques across AD DS, AD CS and AD FS, with detection methods and mitigations.
- Confirmed examples highlighted by public agency pages include Kerberoasting, Authentication Server Response roasting and password spraying.
- Reported agency framing emphasizes why Active Directory remains a high-value target: it centralizes authentication, authorization, policy and administrative trust for many enterprise environments.
This is guidance, not disclosure of one new CVE. The risk is operational: attackers repeatedly win by abusing identity configuration, weak credentials, legacy protocols and overlooked trust paths.
Who is affected?
Organizations running Microsoft Active Directory, especially hybrid identity environments that connect on-premises AD to cloud identity, should treat the update as relevant.
Likely exposure is highest where teams have:
- broad service account privileges;
- stale SPNs and weak service account passwords;
- user accounts without Kerberos pre-authentication;
- permissive MachineAccountQuota settings;
- weak segmentation between workstations, servers and domain controllers;
- limited logging for Kerberos, LDAP, certificate services and privileged group changes;
- unclear ownership of Tier 0 identity systems.
Even mature security programs can miss this class of risk because identity and access management spans infrastructure, endpoint, cloud, audit and helpdesk teams.
Initial access & kill chain (MITRE-friendly)
Active Directory compromise usually begins after an attacker gains a valid credential or endpoint foothold. From there, the identity system becomes the map, the escalation path and often the persistence layer.
| Phase | Common attacker behavior | Defender focus |
|---|---|---|
| Initial access | Phishing, exposed remote access, stolen passwords or endpoint compromise | MFA coverage, impossible travel, risky sign-ins, remote access logs |
| Discovery | LDAP queries, domain enumeration, group and trust mapping | Abnormal directory query volume, BloodHound-like collection patterns |
| Credential access | Kerberoasting, AS-REP roasting, LSASS dumping, password spraying | Kerberos event patterns, endpoint memory access, failed login bursts |
| Privilege escalation | Abuse of delegated permissions, certificate templates, GPOs or privileged groups | Tier 0 change monitoring, AD CS review, GPO diffing |
| Lateral movement | Remote services, admin shares, RDP, WinRM and pass-the-hash-style activity | East-west telemetry, privileged logons, admin tool execution |
| Persistence | New privileged accounts, modified GPOs, certificate abuse, federation changes | Change control, domain controller auditing, AD FS and AD CS logs |
The practical lesson: credential theft and lateral movement are not separate stories in an AD intrusion. They reinforce each other until the attacker reaches domain-level influence.
Indicators and detection
EDR
Look for processes reading LSASS memory, unexpected credential tooling, PowerShell or command interpreters launched from user workstations and remote execution utilities running under unusual accounts. Correlate endpoint signals with privileged logons rather than triaging them in isolation.
Email security
Treat targeted phishing against administrators, helpdesk users and finance staff as identity-risk telemetry. A blocked email campaign can still reveal which accounts attackers consider worth stealing.
Identity, SSO and OAuth
Review Kerberos events for unusual ticket requests, repeated pre-authentication failures, service ticket spikes and password spray patterns. In hybrid environments, pair on-premises events with Entra ID, SSO and federation logs.
Network, proxy and DNS
Monitor unusual LDAP query volume, domain controller access from non-administrative segments, anomalous SMB/RPC patterns and outbound traffic from domain controllers. Domain controllers should rarely behave like ordinary endpoints.
Example Sentinel KQL pattern
The following is an example pattern to hunt for password spraying behavior. Tune thresholds and event IDs for your environment.
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4625, 4771)
| summarize FailedAccounts=dcount(Account), Attempts=count(), Targets=dcount(Computer)
by IpAddress, bin(TimeGenerated, 15m)
| where Attempts > 30 and FailedAccounts > 10
| order by Attempts desc
For Kerberoasting hunts, prioritize unusual spikes in service ticket requests, especially where the requesting account rarely accesses the targeted SPN or where legacy encryption is still allowed.
Containment & remediation checklist
Immediate containment (0-24h)
- Confirm domain controller, AD CS and AD FS logging is enabled and retained.
- Review privileged group membership changes from the last 30 days.
- Identify service accounts with SPNs and weak or non-rotated passwords.
- Investigate bursts of failed logons across many accounts from one source.
- Disable or reset accounts with confirmed compromise indicators.
- Isolate endpoints showing credential dumping or suspicious admin tooling.
- Validate recent GPO changes and rollback unauthorized modifications.
- Check whether domain controllers initiated unusual outbound connections.
Hardening (24-72h)
- Enforce strong, unique service account passwords or managed service accounts.
- Disable Kerberos pre-authentication exceptions unless explicitly required.
- Reduce MachineAccountQuota where business processes do not require self-service joins.
- Audit AD CS templates for dangerous enrollment, authentication and manager approval settings.
- Restrict administrative logons to hardened management hosts.
- Segment domain controllers from ordinary user and server networks.
- Expand detections for Kerberoasting, AS-REP roasting and password spraying.
- Review AD FS claims, token signing certificates and federation trust changes.
Longer-term controls (1-4 weeks)
- Implement a Tier 0 administration model for identity infrastructure.
- Run an attack-path assessment for AD DS, AD CS and hybrid identity.
- Move high-risk admins to phishing-resistant MFA.
- Establish routine GPO, privileged group and certificate template review.
- Test identity recovery procedures, including domain controller recovery.
- Build detections into the SOC queue with documented triage steps.
- Use purple-team exercises to validate whether identity alerts produce action.
- Tie incident response playbooks to specific AD compromise scenarios.
Strategic analysis: what this signals
The updated guidance reflects a broader trend: identity is the control plane attackers want most. Ransomware crews, espionage groups and access brokers do not need a novel exploit if they can obtain a valid credential, enumerate trust relationships and quietly escalate.
Active Directory also concentrates technical debt. Legacy protocols, old service accounts, forgotten certificate templates and permissive delegation often survive because they keep business systems working. That makes identity compromise a governance problem as much as a SOC problem.
The clearest takeaway for defenders is to move from "is AD patched?" to "can we prove AD abuse would be detected quickly?" The answer depends on telemetry, ownership and rehearsed response, not on one control alone.
References
FAQ
CISA and partner agencies updated joint guidance on detecting and mitigating Active Directory compromise techniques. The guidance covers 17 common techniques and gives defenders detection and mitigation direction.
Organizations using Microsoft Active Directory, Active Directory Certificate Services or Active Directory Federation Services are affected. Hybrid identity environments should review both on-premises and cloud identity telemetry.
Start by checking for weak service account passwords, accounts without Kerberos pre-authentication, risky AD CS templates and password spraying patterns. Then validate whether your SOC can detect and investigate those behaviors.
Confirm logging on domain controllers, review privileged group changes and hunt for Kerberoasting, AS-REP roasting and password spraying. These checks give a fast view into common attacker paths.
No. The guidance is not a single CVE disclosure. It is a consolidated defensive guide for common AD compromise techniques that attackers continue to use.
Active Directory controls authentication, authorization, policy and administrative trust for many organizations. If attackers compromise it, they can often move from one account to broad enterprise control.
Patch management still matters, but the immediate priority is identity risk reduction. Focus on credential exposure, misconfiguration, privileged paths and detection coverage.