Active Directory Attacks

Where each attack hooks into sign-in, what it needs first, what it gives, and what your tools can see.

Active Directory holds a Windows domain’s accounts, and its domain controllers prove who each one is. An attack on it goes after the accounts, keys and tickets behind that proof. With one account’s secret, or a forged proof, an attacker signs in as that account, and at the last stage controls the domain itself.

Each page covers one attack as a defender’s case notes. It says what the attack bends in sign-in, what it needs and gives, what is logged and where, what that does not prove, and how to confirm and prevent it.

The evidence sits in two places. A domain controller records who proved an identity and what it issued, and the machine that was reached records who got in and with what rights. Reading an attack means pulling both.

Where to Start

New to this? Read these in order.

New to Kerberos and NTLM? Read How Active Directory Sign-In Works first, so the keys, tickets and events each attack bends make sense.

Then pick an attack in the explorer below to see what it needs, what it gives, how it plays out and what your tools can see.

Each attack sits in a stage, from getting first access to owning the domain, and the sidebar lists the stages in that order.

Attack Explorer

Getting First Access

Cracking Offline

Stealing Stored Credentials

Reusing Stolen Secrets

Forging Tickets

Owning the Domain

Mapping and Takeover

Covering Tracks

Kerberoasting

Asks for service tickets, then guesses the service account's password offline.

Technique: MITRE ATT&CK T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting (opens in a new tab)
Hooks Into: Kerberos TGS Request Kerberos TGS Reply
Needs
Gives

How It Plays Out

Go through it one step at a time, with what travels in each step and what a defender can see.

Read how Kerberoasting plays out, step by step, on its own page.

Arrow keys step through it

Can Your Tools See It?

How well each tool sees this attack, and the query to run in the one you use.

Open the Full Page for Kerberoasting

31 attacksUp and Down walk the list

How the Attacks Connect

What one attack gives, the next one needs. Each row names an asset, the attacks that give it and those that use it.

Asset	What It Is	Given By	Used By
Network Access	A machine that can reach domain controllers and servers, with no account yet.	None of these attacks	Password Spraying AS-REP Roasting Zerologon
A Place on the Local Network	A device on the same network segment as its victims, which hears the name queries DNS could not answer.	None of these attacks	Password Spraying LLMNR, NBT-NS and mDNS Poisoning AS-REP Roasting Zerologon
An Incoming Sign-In	A machine signing in to a host the attacker controls, after a poisoned answer or a forced callback.	LLMNR, NBT-NS and mDNS Poisoning Forced Authentication (Coercion)	NTLM Relay NTLMv1 Downgrade Certificate Services Abuse
A Domain Account	Any account in the domain, or a domain-joined machine running as SYSTEM, which acts as its computer account.	Password Spraying	Forced Authentication (Coercion)Kerberoasting AS-REP Roasting Diamond and Sapphire Tickets Certificate Services Abuse Active Directory Reconnaissance noPac (sAMAccountName Spoofing)
Local Admin Rights	Administrator rights on one machine, with its hives and, unless a protection stops it, LSASS memory in reach.	Pass-the-Hash Pass-the-Ticket Silver Ticket Golden Ticket Diamond and Sapphire Tickets Certificate Services Abuse noPac (sAMAccountName Spoofing)AdminSDHolder and SID History Group Policy Abuse LAPS and gMSA Password Reads	LSASS Memory Theft SAM, LSA Secrets and Cached Logons Clearing and Silencing Logs
An NT Hash	An account's password hash, which NTLM uses as its key and Kerberos as its RC4 key.	Password Spraying LLMNR, NBT-NS and mDNS Poisoning NTLMv1 Downgrade Kerberoasting AS-REP Roasting LSASS Memory Theft SAM, LSA Secrets and Cached Logons NTDS.dit Theft DCSync Certificate Services Abuse Shadow Credentials	Pass-the-Hash Overpass-the-Hash
An AES Key	An account's Kerberos AES key, made from its password.	Password Spraying LLMNR, NBT-NS and mDNS Poisoning Kerberoasting AS-REP Roasting LSASS Memory Theft SAM, LSA Secrets and Cached Logons NTDS.dit Theft DCSync	Overpass-the-Hash
A TGT	A ticket-granting ticket and its session key, which prove a sign-in until the ticket expires.	LSASS Memory Theft Overpass-the-Hash Kerberos Delegation Abuse Golden Ticket Diamond and Sapphire Tickets	Pass-the-Ticket
A Service Ticket	A ticket to one service and its session key, accepted by that service until it expires.	Kerberos Delegation Abuse	Pass-the-Ticket
A Password	An account's password in clear, which gives its NT hash and AES keys too.	Password Spraying LLMNR, NBT-NS and mDNS Poisoning Kerberoasting AS-REP Roasting SAM, LSA Secrets and Cached Logons	Pass-the-Hash Overpass-the-Hash
A Service's Key	The key of the account that runs a service, which seals every ticket to it.	Kerberoasting SAM, LSA Secrets and Cached Logons NTDS.dit Theft DCSync LAPS and gMSA Password Reads	Silver Ticket
The krbtgt Key	The key that seals and signs the TGTs the domain's writable domain controllers issue.	NTDS.dit Theft DCSync	Golden Ticket Diamond and Sapphire Tickets DCShadow
Replication Rights	The rights to have a domain controller replicate account secrets, held by DCs, the admin groups and few others.	NTLMv1 Downgrade Kerberos Delegation Abuse Golden Ticket Diamond and Sapphire Tickets Certificate Services Abuse noPac (sAMAccountName Spoofing)Zerologon AdminSDHolder and SID History	DCSync
Domain Admin Rights	Control of the domain's accounts, its domain controllers and the directory itself.	Golden Ticket Diamond and Sapphire Tickets Certificate Services Abuse noPac (sAMAccountName Spoofing)AdminSDHolder and SID History	LSASS Memory Theft SAM, LSA Secrets and Cached Logons NTDS.dit Theft DCSync DCShadow Skeleton Key AdminSDHolder and SID History Group Policy Abuse Backdoor Accounts and Group Changes Clearing and Silencing Logs LAPS and gMSA Password Reads
Code on a Domain Controller	Code running on a DC as SYSTEM, with the directory database and LSASS within reach.	Golden Ticket Diamond and Sapphire Tickets Certificate Services Abuse noPac (sAMAccountName Spoofing)AdminSDHolder and SID History	NTDS.dit Theft Skeleton Key
A Server Trusted for Delegation	Control of a server allowed to act for users elsewhere, which receives or asks for tickets in their name.	None of these attacks	Kerberos Delegation Abuse
Write Access to a Directory Object	Rights to change one object's attributes, such as a computer's delegation setting or a certificate template.	DCShadow	Kerberos Delegation Abuse Shadow Credentials Delegated Managed Service Account Abuse AdminSDHolder and SID History Group Policy Abuse Backdoor Accounts and Group Changes
A Sign-In Certificate	A certificate and its private key that the domain accepts for sign-in as an account.	Certificate Services Abuse	None of these attacks
Access as Another Account	Signed in as the account whose secret was used, reaching whatever that account can reach.	NTLM Relay Pass-the-Hash Overpass-the-Hash Pass-the-Ticket Silver Ticket Skeleton Key Shadow Credentials Delegated Managed Service Account Abuse Backdoor Accounts and Group Changes	None of these attacks
A DC's Computer Account	A domain controller's own computer account, held as its TGT, its key or a certificate issued for it.	NTLMv1 Downgrade Kerberos Delegation Abuse Certificate Services Abuse Zerologon	DCSync

What Stops Them

Every control the attack pages name, with the ones that break the most attacks first.

Control	What It Does	Attacks It Breaks
Tiered administration (opens in a new tab)	Keeps each admin account to its own tier and its own privileged access workstation, so its credentials stay off the machines attackers start from.	LSASS Memory Theft SAM, LSA Secrets and Cached Logons NTDS.dit Theft DCSync Pass-the-Hash Overpass-the-Hash Pass-the-Ticket DCShadow Active Directory Reconnaissance Shadow Credentials noPac (sAMAccountName Spoofing)Delegated Managed Service Account Abuse AdminSDHolder and SID History Group Policy Abuse Backdoor Accounts and Group Changes Clearing and Silencing Logs
Least-privilege administration (opens in a new tab)	Keeps Domain Admins and the other most powerful groups nearly empty, and gives each admin only the rights a task needs.	NTDS.dit Theft DCSync Silver Ticket Golden Ticket DCShadow Skeleton Key Active Directory Reconnaissance Shadow Credentials noPac (sAMAccountName Spoofing)Delegated Managed Service Account Abuse AdminSDHolder and SID History Group Policy Abuse Backdoor Accounts and Group Changes
Credential Guard (opens in a new tab) Check it on a machine: Credential Guard (LsaCfgFlags)	Isolates NTLM hashes, Kerberos TGTs and saved domain credentials with virtualisation-based security, out of reach of code on the machine, admin code included.	NTLMv1 Downgrade LSASS Memory Theft Pass-the-Hash Overpass-the-Hash Pass-the-Ticket Kerberos Delegation Abuse
Replication rights reviewed (opens in a new tab)	Removes the right to replicate secrets from every account that is not a domain controller, and keeps the Entra Connect account's to what it needs.	DCSync Golden Ticket Diamond and Sapphire Tickets DCShadow AdminSDHolder and SID History LAPS and gMSA Password Reads
Protected Users group (opens in a new tab)	Members cannot sign in with NTLM, use DES or RC4 in Kerberos or be delegated, and their machines keep no password, NT hash or long-term key for them.	LSASS Memory Theft Pass-the-Hash Overpass-the-Hash Pass-the-Ticket Kerberos Delegation Abuse
NTLM restrictions (opens in a new tab)	Audit where NTLM is still used, then refuse it, keeping exceptions only for the servers that cannot use Kerberos yet.	Forced Authentication (Coercion)NTLM Relay NTLMv1 Downgrade Pass-the-Hash Certificate Services Abuse
krbtgt password reset (opens in a new tab)	Resets the krbtgt password twice, waiting at least the maximum ticket lifetime in between, so TGTs forged with a stolen key stop working.	NTDS.dit Theft DCSync Golden Ticket Diamond and Sapphire Tickets Zerologon
Hardened domain controllers (opens in a new tab)	Treats domain controllers as the most sensitive systems, physically secured and, when virtual, kept on separate hosts with storage other administrators cannot reach.	NTDS.dit Theft Golden Ticket Diamond and Sapphire Tickets Skeleton Key Zerologon
Honeytoken accounts (opens in a new tab)	Dormant decoy accounts tagged in Defender for Identity, so a sign-in with one, or an LDAP query for one, raises an alert.	Password Spraying Kerberoasting AS-REP Roasting Active Directory Reconnaissance Backdoor Accounts and Group Changes
Windows LAPS (opens in a new tab)	Gives each machine's local administrator its own managed password, backed up to the directory, so one local hash does not open every machine.	SAM, LSA Secrets and Cached Logons Pass-the-Hash Silver Ticket LAPS and gMSA Password Reads
Group managed service accounts (opens in a new tab)	Service accounts whose long random passwords Windows manages and changes, so tickets sealed with their keys cannot be guessed offline.	Kerberoasting SAM, LSA Secrets and Cached Logons Silver Ticket LAPS and gMSA Password Reads
Microsoft Entra Password Protection (opens in a new tab)	Domain controllers reject known weak passwords, and the organisation's own banned terms, whenever a password is set or changed.	Password Spraying LLMNR, NBT-NS and mDNS Poisoning Kerberoasting AS-REP Roasting
Delegated managed service accounts (opens in a new tab)	Windows Server 2025 accounts that take over from a service account with managed, fully random keys, usable only from the machines named for them.	Kerberoasting Delegated Managed Service Account Abuse LAPS and gMSA Password Reads
AES only for Kerberos (opens in a new tab)	Finds what still uses RC4 for Kerberos and moves it to AES, so no ticket or timestamp is sealed with a key that is simply an NT hash.	Kerberoasting AS-REP Roasting Overpass-the-Hash
Extended Protection for Authentication (opens in a new tab)	Ties a Windows sign-in over HTTPS to its TLS channel, so a sign-in relayed to AD CS web enrolment, or another site that requires it, is refused.	Forced Authentication (Coercion)NTLM Relay Certificate Services Abuse
Remote Credential Guard (opens in a new tab) Check it on a machine: Restricted Admin Mode	Remote Desktop that never hands the server an admin's credentials. Its Kerberos requests go back to the admin's own machine.	LSASS Memory Theft Pass-the-Ticket
LSA protection (opens in a new tab) Check it on a machine: LSA Protection (RunAsPPL)	Runs LSASS as a protected process, so other processes, admin ones included, cannot read its memory or inject code, and it loads only Microsoft-signed modules.	LSASS Memory Theft Skeleton Key
SMB signing (opens in a new tab)	Signs every SMB message with a key from the sign-in, which a machine relaying that sign-in cannot work out, so a relayed session is useless.	LLMNR, NBT-NS and mDNS Poisoning NTLM Relay
SMB NTLM blocking (opens in a new tab)	The SMB client stops offering NTLM on outbound connections, so a poisoned or forced connection gets no NTLM answer to relay or guess offline.	LLMNR, NBT-NS and mDNS Poisoning Forced Authentication (Coercion)
LDAP signing (opens in a new tab)	Domain controllers refuse LDAP binds that are neither signed nor protected by TLS, so an NTLM sign-in relayed to LDAP is turned away.	Forced Authentication (Coercion)NTLM Relay
LDAP channel binding (opens in a new tab)	Ties an LDAP sign-in over TLS to that TLS session, so a sign-in relayed over a different connection is refused.	Forced Authentication (Coercion)NTLM Relay
Print Spooler off on domain controllers (opens in a new tab)	Stops the Print Spooler service on domain controllers, which removes one way to make a DC sign in to another machine.	Forced Authentication (Coercion)Kerberos Delegation Abuse
Local admins kept off the network (opens in a new tab) Check it on a machine: User Account Control Settings	Denies local administrator accounts network and Remote Desktop logons, and keeps remote UAC filtering on, so a stolen local hash does not open other machines.	SAM, LSA Secrets and Cached Logons Pass-the-Hash
No unconstrained delegation (opens in a new tab)	Replaces unconstrained delegation with constrained or resource-based delegation, so servers stop receiving copies of users' TGTs.	Forced Authentication (Coercion)Kerberos Delegation Abuse
MachineAccountQuota at zero (opens in a new tab)	Sets ms-DS-MachineAccountQuota to 0, so ordinary users cannot create computer accounts (by default each may create ten).	Kerberos Delegation Abuse noPac (sAMAccountName Spoofing)
Strong certificate mapping (opens in a new tab)	Domain controllers accept a certificate for sign-in only when it maps strongly to its account, through the SID extension or an explicit mapping.	Certificate Services Abuse Shadow Credentials
NTLMv2 only (opens in a new tab) Check it on a machine: LM Hash Storage (NoLMHash)	Sets the LAN Manager authentication level to send NTLMv2 only and refuse LM and NTLM, so no weak version 1 answer is sent or accepted.	NTLMv1 Downgrade
SMB server SPN validation (opens in a new tab)	The SMB server checks the name the client meant to reach, sent in NTLMv2 and Kerberos sign-ins, and refuses a session meant for another machine.	NTLM Relay
SMB authentication rate limiter (opens in a new tab)	The SMB server pauses after each failed NTLM sign-in, which slows password guessing. It is on by default in Windows Server 2025 and Windows 11 24H2.	Password Spraying
LLMNR turned off (opens in a new tab)	Clients stop asking the local network over LLMNR for names DNS cannot resolve, so no device there can answer for them.	LLMNR, NBT-NS and mDNS Poisoning
NetBIOS name resolution turned off (opens in a new tab)	Clients never fall back to NetBIOS name resolution, which any device on the same network can answer.	LLMNR, NBT-NS and mDNS Poisoning
ASR rule for LSASS (opens in a new tab)	Microsoft Defender's attack surface reduction rule that locks down LSASS, so processes cannot read credentials from it.	LSASS Memory Theft
WDigest off (opens in a new tab) Check it on a machine: WDigest UseLogonCredential	Keeps WDigest from holding a reusable copy of the password in memory. UseLogonCredential is 0, the default since Windows 8.1 and Windows Server 2012 R2.	LSASS Memory Theft
Fewer cached logons (opens in a new tab) Check it on a machine: Cached Domain Logons	Lowers how many domain logons a machine caches, down to 0 where it always reaches a domain controller, so fewer password verifiers sit on its disk.	SAM, LSA Secrets and Cached Logons
No automatic logon (opens in a new tab) Check it on a machine: Automatic Logon	Stores no password for automatic logon, which Windows keeps in the registry in plain text.	SAM, LSA Secrets and Cached Logons
Sensitive accounts not delegated (opens in a new tab)	Marks privileged accounts "Account is sensitive and cannot be delegated", so no server can act in their name.	Kerberos Delegation Abuse
Kerberos pre-authentication required (opens in a new tab)	Clears "Do not require Kerberos preauthentication" on every account, so the DC never answers a TGT request without proof of the password.	AS-REP Roasting
Hardened certificate templates (opens in a new tab)	Fixes certificate templates that let a requester name any subject, or that ordinary users can change, and limits who may enrol.	Certificate Services Abuse
Account lockout (opens in a new tab)	Locks an account after repeated failed sign-ins, which caps how many guesses any one account takes.	Password Spraying
Windows Event Forwarding (opens in a new tab)	Sends the events you choose from each machine to a collector server as they are logged, so a cleared or shrunk local log still leaves a copy to read.	Clearing and Silencing Logs