Active Directory
Identity
Security
Active Directory Security: Closing the Door on Lateral Movement
ThreatMate Team
Apr 25, 2023
4 min read
Why AD Security Matters
Active Directory controls: - User authentication - Group membership and permissions - Computer account management - Group Policy application
Compromising AD often means game over.
Common AD Attack Paths
Kerberoasting Extracting service account password hashes for offline cracking.
Pass-the-Hash Using stolen NTLM hashes to authenticate without passwords.
DCSync Replicating password hashes directly from domain controllers.
Golden Ticket Forging Kerberos tickets for persistent domain access.
Securing Active Directory
Privileged Access - Tiered admin model - Privileged Access Workstations - Just-in-time administration
Service Accounts - Managed Service Accounts (MSA/gMSA) - Long, complex passwords - Regular rotation
Configuration - Remove legacy protocols - Enable Protected Users group - Configure Fine-Grained Password Policies
Monitoring - Enable advanced audit policies - Monitor for Kerberos anomalies - Alert on DCSync attempts
Regular Assessment
Pentest AD regularly to find: - Privilege escalation paths - Misconfigured permissions - Kerberoastable accounts
ThreatMate includes Active Directory security assessment capabilities.
Ready to secure your attack surface?
See how ThreatMate helps MSPs identify and remediate vulnerabilities across their client base.
