CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory

CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers use to compromise Microsoft Active Directory environments.

The technical guide explains how attackers exploit identity configurations, legacy protocols, certificate services, and privileged systems to escalate access, move laterally, and establish long-term persistence inside enterprise networks.

Developed by the Australian Signals Directorate’s Australian Cyber Security Center in cooperation with the US Cybersecurity and Infrastructure Security Agency and National Security Agency, the guidance also includes contributions from the Canadian Center for Cyber Security, the UK National Cyber Security Center and New Zealand’s National Cyber Security Center.

It covers attacks against Active Directory Domain Services, Active Directory Certificate Services and Active Directory Federation Services.

According to the technical guidance published by CISA, Active Directory remains an attractive target because it controls authentication and authorization across many enterprise systems.

A successful Active Directory compromise can give hackers access to user accounts, workstations, servers, email, business applications and connected cloud services.

The agencies warn that permissive defaults, legacy protocol support and complex relationships between users, groups and systems create a large attack surface that defenders may struggle to understand.

17 Techniques Used by Hackers to Compromise Active Directory

1. Kerberoasting: Attackers request Kerberos service tickets for accounts configured with service principal names (SPNs), then attempt to crack the tickets offline and recover service-account passwords.
2. AS-REP Roasting: Attackers obtain encrypted authentication responses for accounts that do not require Kerberos pre-authentication and crack them offline to recover passwords.
3. Password Spraying: Attackers test a small number of common or previously exposed passwords against many accounts, reducing the likelihood of triggering account lockouts.
4. MachineAccountQuota Compromise: An unprivileged user exploits the domain’s machine-account quota to create a computer object and use its inherited permissions for lateral movement or privilege escalation.
5. Unconstrained Delegation: Attackers compromise a delegation-enabled computer and extract cached Ticket Granting Tickets from LSASS, potentially obtaining credentials belonging to privileged users.
6. Group Policy Preferences Password Compromise: Attackers search SYSVOL for legacy GPP cpassword values, which can be decrypted using a publicly known AES key.
7. AD CS Compromise: Misconfigured Active Directory Certificate Services templates or certificate authorities allow attackers to request authentication certificates for other users, including domain administrators.
8. Golden Certificate: After stealing a certificate authority’s certificate and private key, attackers forge trusted certificates to impersonate users and maintain long-term access.
9. DCSync: An attacker with directory-replication permissions impersonates a domain controller and requests password hashes, including the highly sensitive KRBTGT hash.
10. Dumping ntds.dit: Attackers copy the Active Directory database and SYSTEM registry hive from a domain controller or backup, enabling offline extraction of domain credential hashes.
11. Golden Ticket: Attackers use the compromised KRBTGT hash to forge Kerberos Ticket Granting Tickets, potentially granting themselves extensive domain privileges and persistence.
12. Silver Ticket: Attackers use a stolen service-account or computer-account hash to forge Kerberos service tickets and access specific services without following the normal authentication process.
13. Golden SAML: Attackers steal an AD FS token-signing certificate and private key to forge SAML responses, impersonate users and access federated services such as Microsoft 365 or Azure.
14. Microsoft Entra Connect Compromise: Attackers target Password Hash Synchronization, Pass-Through Authentication or highly privileged synchronization accounts to move between on-premises Active Directory and Microsoft Entra ID.
15. One-Way Domain Trust Bypass: After obtaining a trusted domain object password hash, attackers request Kerberos tickets from another domain and bypass the intended direction of a one-way trust.
16. SID History Compromise: Attackers add a privileged security identifier to an account’s sIDHistory attribute, allowing that account to inherit elevated permissions while concealing the source of access.
17. Skeleton Key: Attackers modify the LSASS authentication process on a domain controller so that a master password works for multiple accounts while legitimate user passwords continue functioning.

Shadow Credentials, which adds an attacker-controlled public key to an account’s msDS-KeyCredentialLink attribute. Shadow Credentials can enable certificate-based authentication as the victim without changing the account’s password, making unauthorized access harder to identify through conventional password monitoring.

The agencies recommend treating domain controllers, certificate authorities, AD FS servers, and Entra Connect systems as Tier 0 assets.

Organizations should isolate privileged administration, deploy phishing-resistant multifactor authentication, use secure administrative workstations, minimize delegated permissions, remove unnecessary service principal names, and replace conventional service accounts with group Managed Service Accounts wherever possible.

Administrators should also enforce Kerberos pre-authentication and AES encryption, set MS-DS-MachineAccountQuota to zero, eliminate unconstrained delegation, remove legacy Group Policy passwords, disable NTLM and SMBv1 where feasible, and protect LSASS.

Reset KRBTGT twice after a suspected compromise, and regularly review certificate templates, SID History, and msDS-KeyCredentialLink modifications. Detection requires centralized monitoring of domain controller, certificate authority, AD FS, and Entra Connect logs.

The guidance highlights events such as 4768 and 4769 for unusual Kerberos activity, 4662 and 5712 for directory replication, 4741 for unexpected computer-account creation, 4886 and 4887 for certificate requests, and 5136 for suspicious directory-object changes.

Establishing normal authentication baselines remains essential because many Active Directory attack techniques deliberately imitate legitimate administrative behavior.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.