Active Directory Compromise: 17 Techniques to Hunt

Active Directory Compromise: 17 Techniques to Hunt | 2026

Executive Summary

CISA, NSA, ASD ACSC, the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK updated joint guidance on September 15, 2026 for detecting and mitigating Microsoft Active Directory compromises. The guide centers on 17 common compromise techniques affecting Active Directory Domain Services, Certificate Services and Federation Services, including Kerberoasting, AS-REP roasting and password spraying. So what? For defenders, this is not a generic hardening memo; it is a practical hunt plan for the identity layer attackers use to turn one foothold into domain-wide control.

The dominant reader action is to review identity telemetry, reduce privileged attack paths and validate whether common Active Directory abuse patterns are already present.

What happened?

• September 15, 2026: CISA listed a revised version of the joint resource "Detecting and Mitigating Active Directory Compromises."
• The guidance is co-authored with Five Eyes cyber agencies and focuses on common ways malicious actors compromise Active Directory environments.
• The resource covers 17 compromise techniques across AD DS, AD CS and AD FS, with detection methods and mitigations.
• Confirmed examples highlighted by public agency pages include Kerberoasting, Authentication Server Response roasting and password spraying.
• Reported agency framing emphasizes why Active Directory remains a high-value target: it centralizes authentication, authorization, policy and administrative trust for many enterprise environments.

This is guidance, not disclosure of one new CVE. The risk is operational: attackers repeatedly win by abusing identity configuration, weak credentials, legacy protocols and overlooked trust paths.

Who is affected?

Organizations running Microsoft Active Directory, especially hybrid identity environments that connect on-premises AD to cloud identity, should treat the update as relevant.

Likely exposure is highest where teams have:

• broad service account privileges;
• stale SPNs and weak service account passwords;
• user accounts without Kerberos pre-authentication;
• permissive MachineAccountQuota settings;
• weak segmentation between workstations, servers and domain controllers;
• limited logging for Kerberos, LDAP, certificate services and privileged group changes;
• unclear ownership of Tier 0 identity systems.

Even mature security programs can miss this class of risk because identity and access management spans infrastructure, endpoint, cloud, audit and helpdesk teams.

Initial access & kill chain (MITRE-friendly)

Active Directory compromise usually begins after an attacker gains a valid credential or endpoint foothold. From there, the identity system becomes the map, the escalation path and often the persistence layer.

Phase	Common attacker behavior	Defender focus
Initial access	Phishing, exposed remote access, stolen passwords or endpoint compromise	MFA coverage, impossible travel, risky sign-ins, remote access logs
Discovery	LDAP queries, domain enumeration, group and trust mapping	Abnormal directory query volume, BloodHound-like collection patterns
Credential access	Kerberoasting, AS-REP roasting, LSASS dumping, password spraying	Kerberos event patterns, endpoint memory access, failed login bursts
Privilege escalation	Abuse of delegated permissions, certificate templates, GPOs or privileged groups	Tier 0 change monitoring, AD CS review, GPO diffing
Lateral movement	Remote services, admin shares, RDP, WinRM and pass-the-hash-style activity	East-west telemetry, privileged logons, admin tool execution
Persistence	New privileged accounts, modified GPOs, certificate abuse, federation changes	Change control, domain controller auditing, AD FS and AD CS logs

The practical lesson: credential theft and lateral movement are not separate stories in an AD intrusion. They reinforce each other until the attacker reaches domain-level influence.

Indicators and detection

EDR

Look for processes reading LSASS memory, unexpected credential tooling, PowerShell or command interpreters launched from user workstations and remote execution utilities running under unusual accounts. Correlate endpoint signals with privileged logons rather than triaging them in isolation.

Email security

Treat targeted phishing against administrators, helpdesk users and finance staff as identity-risk telemetry. A blocked email campaign can still reveal which accounts attackers consider worth stealing.

Identity, SSO and OAuth

Review Kerberos events for unusual ticket requests, repeated pre-authentication failures, service ticket spikes and password spray patterns. In hybrid environments, pair on-premises events with Entra ID, SSO and federation logs.

Network, proxy and DNS

Monitor unusual LDAP query volume, domain controller access from non-administrative segments, anomalous SMB/RPC patterns and outbound traffic from domain controllers. Domain controllers should rarely behave like ordinary endpoints.

Example Sentinel KQL pattern

The following is an example pattern to hunt for password spraying behavior. Tune thresholds and event IDs for your environment.

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4625, 4771)
| summarize FailedAccounts=dcount(Account), Attempts=count(), Targets=dcount(Computer)
    by IpAddress, bin(TimeGenerated, 15m)
| where Attempts > 30 and FailedAccounts > 10
| order by Attempts desc

For Kerberoasting hunts, prioritize unusual spikes in service ticket requests, especially where the requesting account rarely accesses the targeted SPN or where legacy encryption is still allowed.

Containment & remediation checklist

Immediate containment (0-24h)

• Confirm domain controller, AD CS and AD FS logging is enabled and retained.
• Review privileged group membership changes from the last 30 days.
• Identify service accounts with SPNs and weak or non-rotated passwords.
• Investigate bursts of failed logons across many accounts from one source.
• Disable or reset accounts with confirmed compromise indicators.
• Isolate endpoints showing credential dumping or suspicious admin tooling.
• Validate recent GPO changes and rollback unauthorized modifications.
• Check whether domain controllers initiated unusual outbound connections.

Hardening (24-72h)

• Enforce strong, unique service account passwords or managed service accounts.
• Disable Kerberos pre-authentication exceptions unless explicitly required.
• Reduce MachineAccountQuota where business processes do not require self-service joins.
• Audit AD CS templates for dangerous enrollment, authentication and manager approval settings.
• Restrict administrative logons to hardened management hosts.
• Segment domain controllers from ordinary user and server networks.
• Expand detections for Kerberoasting, AS-REP roasting and password spraying.
• Review AD FS claims, token signing certificates and federation trust changes.

Longer-term controls (1-4 weeks)

• Implement a Tier 0 administration model for identity infrastructure.
• Run an attack-path assessment for AD DS, AD CS and hybrid identity.
• Move high-risk admins to phishing-resistant MFA.
• Establish routine GPO, privileged group and certificate template review.
• Test identity recovery procedures, including domain controller recovery.
• Build detections into the SOC queue with documented triage steps.
• Use purple-team exercises to validate whether identity alerts produce action.
• Tie incident response playbooks to specific AD compromise scenarios.

Strategic analysis: what this signals

The updated guidance reflects a broader trend: identity is the control plane attackers want most. Ransomware crews, espionage groups and access brokers do not need a novel exploit if they can obtain a valid credential, enumerate trust relationships and quietly escalate.

Active Directory also concentrates technical debt. Legacy protocols, old service accounts, forgotten certificate templates and permissive delegation often survive because they keep business systems working. That makes identity compromise a governance problem as much as a SOC problem.

The clearest takeaway for defenders is to move from "is AD patched?" to "can we prove AD abuse would be detected quickly?" The answer depends on telemetry, ownership and rehearsed response, not on one control alone.

References

1. Detecting and Mitigating Active Directory Compromises
2. Updated guidance on detecting and mitigating Active Directory compromises
3. NSA jointly releases guidance for mitigating Active Directory compromises
4. Detecting and Mitigating Active Directory Compromises
5. Enterprise ATT&CK knowledge base