First published in September 2024 and updated in January 2025, this new guidance describes 17 common techniques threat actors use to compromise Microsoft’s Active Directory. Cybersecurity and Infrastructure Security Agency (CISA), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), and partners updated the joint guidance entitled, “Detecting and Mitigating Active Directory Compromises.”
Because it sits at the center of identity and access, compromising Active Directory often equates to compromising the entire enterprise, allowing malicious actors to access systems, data, and business applications.
Right now the agencies involved in the guidance said there are 17 common techniques used to target Active Directory.
Guidance Topics
Key themes of the guidance include:
- Understanding and baselining Active Directory
- Detecting common credential theft and authentication compromises
- Hardening Active Directory configuration to prevent privilege escalation and persistence
- Identifying indicators of full domain compromise
- Strengthening monitoring and logging
Active Directory’s susceptibility to compromise is, in part, because every has sufficient permission to enable them to both identify and exploit weaknesses. These permissions make Active Directory’s attack surface exceptionally large and difficult to defend against.
To gain a better understanding of an organization’s environment, malicious actors commonly enumerate Active Directory for information after gaining initial access to an environment . Using the information gained, they seek to understand the structure, objects, configurations and relationships that are unique to each organization.
The immediate objective of malicious activity involving Active Directory is to escalate privileges and gain control of a domain by targeting the highest privileged user objects, such as those in the Domain Admins and Enterprise Admins security groups. Although significant access can often end up obtained by targeting other user objects, such as service accounts, preventing malicious actors from acquiring the highest privileges is crucial for limiting their overall access.
Securing Privileged Access
Therefore, securing privileged access is essential for mitigating Active Directory compromises and should be a top priority for all organizations.
Securing privileged access in Active Directory can be achieved by using a tiered model, such as Microsoft’s Enterprise Access Model. This model supersedes and advances the previous tiered model, commonly referred to as the Active Directory Administrative Tier Model.
The Enterprise Access Model is intended for hybrid environments – which are increasingly prevalent – where Active Directory is connected to cloud services, such as those in Microsoft Azure, using Microsoft Entra ID through Entra Connect or AD Federated Servcie (FS).
Click here for more on the guidance.