Active-Directory

The GoldenDMSA tool facilitates unauthorized manipulation and authentication bypass against Active Directory Group Managed Service Accounts (gMSA).

This brief documents the use of the PowerView PowerShell cmdlet Get-DomainSPNTicket to conduct Kerberoasting, a technique that extracts Kerberos service tickets for offline password cracking.

Attackers utilize the PowerView 'Invoke-ShareFinder' PowerShell cmdlet to discover network file shares, potentially exposing sensitive data for lateral movement and privilege escalation.

Threat actors, including Wizard Spider and FIN6, frequently abuse the legitimate AdFind.exe utility to perform unauthorized Active Directory reconnaissance to facilitate lateral movement and privilege escalation.

Attackers may reset the Directory Services Restore Mode (DSRM) administrator password on Domain Controllers to maintain persistent, high-privileged administrative access.

Adversaries and Red Teams utilize the [adsisearcher] PowerShell type accelerator to perform Active Directory reconnaissance by querying for domain computer objects.

Adversaries leverage nltest.exe to enumerate Active Directory domain trust relationships, facilitating lateral movement and network reconnaissance in post-compromise environments.

Adversaries utilize the Get-WmiObject cmdlet via PowerShell to perform Active Directory domain computer enumeration, facilitating lateral movement planning.

Adversaries utilize the PowerView PowerShell cmdlet 'Get-DomainGroup' to perform Active Directory reconnaissance and map domain structures, facilitating subsequent privilege escalation and lateral movement.

Adversaries leverage the PowerView cmdlet 'Get-DomainGroup' via PowerShell to perform Active Directory reconnaissance and identify group memberships for lateral movement.

This detection targets the execution of the PowerShell command 'Get-DomainController', often used by attackers to enumerate domain infrastructure as part of Active Directory discovery.

Adversaries may use the .NET System.Security.Principal.WindowsIdentity::GetCurrent() method via PowerShell to perform system discovery and identify the current user context.

This detection identifies the execution of the Get-ForestTrust PowerShell command, which adversaries use to map Active Directory forest trust relationships for lateral movement and privilege escalation.

Adversaries utilize the Get-DomainUser cmdlet within the PowerView framework to perform Active Directory reconnaissance and user enumeration.

Adversaries utilize the PowerView PowerShell module's Get-DomainTrust command to perform Active Directory reconnaissance, facilitating lateral movement planning by mapping domain trust relationships.

Adversaries leverage the native Windows utility dsquery.exe to map Active Directory domain trusts, facilitating lateral movement and privilege escalation.

SharpHound is a widely used tool for Active Directory enumeration, enabling attackers to perform reconnaissance, map network relationships, and identify paths for lateral movement and privilege escalation.

AdFind.exe is a legitimate Active Directory query tool frequently repurposed by threat actors for post-exploitation reconnaissance in ransomware and criminal campaigns.

Detection of unauthorized removal of success or failure audit policies on Domain Controllers, a critical defense evasion tactic used by attackers to hide malicious activity.

Attackers modify the Access Control List of the AdminSDHolder object in Active Directory to establish domain persistence and escalate privileges by leveraging the automated Security Descriptor Propagator process.

Adversaries utilize the System.IdentityModel.Tokens.KerberosRequestorSecurityToken class via PowerShell command lines to conduct Kerberoasting and ticket-based credential access attacks.

Adversaries leverage Linux-based systems to coerce Windows hosts into authenticating against attacker-controlled resources via SMB named pipes, facilitating NTLM hash capture and SMB relay attacks.

Active Directory Rights Management Services (AD RMS) utilizes a non-rotatable Server Licensor Certificate master key that, if compromised, allows for the indefinite offline decryption of all protected corporate data.

Adversaries utilize the SharpView C# port of PowerView to perform extensive Active Directory reconnaissance, domain enumeration, and discovery of sensitive network objects.

Detection logic for PowerShell scripts leveraging the .NET KerberosRequestorSecurityToken class to illicitly request Kerberos tickets, a common step in Kerberoasting.

Adversaries are utilizing the Get-ADComputer PowerShell cmdlet to enumerate Active Directory objects configured for unconstrained delegation, a reconnaissance step often preceding ticket-based credential theft.

Adversaries may use the System.DirectoryServices.AccountManagement namespace in PowerShell to programmatically create or manipulate domain accounts for persistence within Active Directory environments.

Detection of suspicious PowerShell scripts utilizing System.DirectoryServices.DirectorySearcher to enumerate Active Directory computer objects, a technique often used in reconnaissance.

Detection of PowerShell activity used to enumerate Active Directory accounts with the DONT_REQ_PREAUTH flag, a precursor to AS-REP roasting attacks.

The DSInternals PowerShell module is frequently abused by threat actors to perform unauthorized credential dumping, Active Directory offline database manipulation, and password auditing.

Adversaries utilize the nslookup utility to identify domain controllers through specific LDAP service record queries, a common step in network reconnaissance to facilitate domain-wide enumeration.

Detection of the .NET-based SOAPHound utility used for unauthorized extraction of Active Directory data via Active Directory Web Services.

Adversaries utilize BloodHound and SharpHound to perform automated reconnaissance and enumeration of Active Directory environments, facilitating lateral movement and privilege escalation.

CVE-2026-59998 describes an undocumented security-relevant behavior in sshd, a component of OpenSSH, specifically in versions prior to 10.4, where the GSSAPIStrictAcceptorCheck setting reportedly has no value when the server is operating within a Windows Active Directory environment.

A threat actor was observed in early June 2026 using AI-generated PowerShell scripts for Active Directory enumeration and then deploying s5cmd for data exfiltration after gaining initial access via RDP, indicating a shift towards AI-augmented tradecraft for rapid and aggressive campaigns.

A critical improper authentication vulnerability, CVE-2026-45480, in Microsoft Azure Active Directory allows an unauthorized attacker to bypass authentication mechanisms and elevate privileges over a network, potentially leading to full administrative control of Azure AD and associated resources.

The analytic detects ACL deletion on the domain root object in Active Directory by monitoring Windows Event Log Security event ID 5136, identifying significant AD changes with potentially high impact.

This analytic detects changes to the sIDHistory attribute of user or computer objects within the same domain using Windows Security Event Codes 4738 and 4742, which can be abused by adversaries to gain unauthorized access, maintain persistence, or escalate privileges by inheriting permissions from another account.

This Splunk search detects when the owner of an Active Directory object is updated, potentially granting full control privileges and enabling object hiding, focusing on Windows Event Log ID 5136, and includes lookups for SID resolution.

This analytic detects when an ACL is applied to an organizational unit (OU) to deny listing the objects residing in it; this activity, combined with modifying the owner of the OU, can hide Active Directory objects, even from domain administrators.

Modification of Access Control Lists (ACLs) on the Active Directory domain root object can grant attackers persistent and escalated privileges.

This analytic detects the addition of permissions required for a DCSync attack, specifically DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set, leveraging Windows Security Event Log 5136 to identify when these permissions are granted, which indicates potential preparation for replicating AD objects and exfiltrating sensitive data.

Detection of Active Directory user object ACL modifications that grant dangerous permissions, such as full control or the ability to modify permissions, potentially indicating privilege escalation or malicious activity.

This correlation analytic identifies potential privilege escalation activities within an organization's Active Directory (AD) environment by correlating multiple analytics from the Active Directory Privilege Escalation analytic story within a specified time frame, helping identify coordinated attempts to gain elevated privileges which could lead to unauthorized access to sensitive systems and data.

This correlation identifies potential lateral movement activities within an Active Directory environment by correlating multiple analytics from the Active Directory Lateral Movement analytic story within a specified time frame, potentially leading to privilege escalation, access to sensitive information, and persistence within the environment.

This rule detects potential privilege escalation attempts by exploiting CVE-2021-42278, which involves spoofing the samAccountName attribute to impersonate a domain controller and elevate privileges from a standard domain user to a domain administrator by identifying suspicious computer account name rename events where a machine account name is renamed to a user-like account name.

Detection of modifications to the msDS-ManagedAccountPrecededByLink attribute of a delegated managed service account (dMSA) by an unusual subject account, which attackers can abuse to inherit permissions and elevate privileges in Active Directory.

Modification of the dsHeuristics attribute to exclude groups from SDProp in Active Directory can allow attackers to maintain persistent access to privileged accounts.

Attackers can modify the msDS-AllowedToDelegateTo attribute to KRBTGT, enabling persistent domain access by requesting Kerberos tickets for the KRBTGT service.

Detects modifications to the AdminSDHolder object in Active Directory, which attackers can abuse via the SDProp process to implement a persistent backdoor by manipulating permissions on protected accounts and groups to regain administrative privileges.

Attackers can modify Active Directory object security descriptors to grant DCSync rights to unauthorized accounts, creating a backdoor to extract credential data.

An improper input validation vulnerability (CVE-2026-33826) in Windows Active Directory could allow an authenticated attacker on an adjacent network to execute code.

Detection of PowerShell scripts modifying the msDS-ManagedAccountPrecededByLink attribute, potentially indicating exploitation of the BadSuccessor privilege escalation vulnerability in Windows Server 2025.

Detection of a user being added to an Active Directory group by the SYSTEM account (S-1-5-18) can indicate an attacker with SYSTEM privileges attempting to pivot to a domain account.

This brief covers the detection of modifications to privileged Active Directory groups, potentially linked to the exploitation of CVE-2024-37085, where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems.

Detection of DNS record creation by non-system accounts within Active Directory Integrated DNS (ADIDNS), which attackers can abuse to perform Dynamic Spoofing attacks, potentially targeting services like WPAD for credential access.

Attackers can create wildcard records in Active Directory Integrated DNS (ADIDNS) to redirect traffic, enabling adversary-in-the-middle attacks for credential interception or relay.

Adversaries perform Active Directory reconnaissance using built-in tools like nltest, whoami, and net.exe to map the environment before deploying ransomware.

Adversaries may abuse the Active Directory Web Service (ADWS) to enumerate network resources and user accounts, by loading AD-related modules followed by a network connection to the ADWS dedicated TCP port.

Adversaries may use the SharpHound tool to collect Active Directory data, saving it into default JSON files for BloodHound analysis, potentially leading to privilege escalation or lateral movement.

This rule detects the execution of AdFind.exe with specific command-line arguments used for reconnaissance, often associated with threat actors like Wizard Spider, FIN6, and groups linked to SUNBURST, who use it to enumerate domain controllers.

AdFind.exe, a legitimate Active Directory query tool, is commonly abused by threat actors such as Trickbot, Ryuk, Maze, and FIN6 for post-exploitation Active Directory reconnaissance, enabling enumeration of objects like computers, people, subnets, and domain information.

Detection of Kerberos pre-authentication being disabled for a user account, potentially leading to AS-REP roasting and offline password cracking by attackers with GenericWrite or GenericAll rights over the account.

Attackers perform a burst of Active Directory discovery commands on a Windows host to gather information prior to ransomware deployment.

Attackers can modify the msPKIAccountCredentials attribute in Active Directory user objects to abuse credential roaming, potentially overwriting files for privilege escalation, by injecting malicious credential objects.

Detection of a user account initiating the Active Directory replication process for the first time, potentially indicating a DCSync attack for credential theft and domain compromise.

Detection of a Domain Managed Service Account (DMSA) creation event by a user that typically does not perform this administrative task, potentially indicating privilege escalation or account compromise.

The creation of a new Delegated Managed Service Account (DMSA) within specific Organizational Units (OUs) using the New-ADServiceAccount cmdlet is indicative of potential BadSuccessor privilege escalation attempts in Windows Server 2025 Active Directory environments.

Detection of the assignment of the SeEnableDelegationPrivilege user right to a principal can indicate potential Active Directory compromise and privilege elevation by attackers.

Detects modifications to a Windows computer account's User Account Control flags, specifically the `SERVER_TRUST_ACCOUNT` flag, potentially indicating unauthorized domain controller promotion or privilege escalation within Active Directory.

The threat brief details the detection of NetExec (formerly CrackMapExec), a post-exploitation tool used for Active Directory penetration testing and network enumeration, often employed by threat actors for lateral movement and credential harvesting.

AdExplorer, a legitimate Active Directory viewer, can be abused by adversaries for domain reconnaissance, and this rule detects its execution to identify potential malicious discovery activities.

This brief details the detection of unauthorized modifications to Active Directory domain replication Access Control Lists (ACLs), specifically targeting permissions that enable DCSync attacks, potentially leading to sensitive data exfiltration and privilege escalation.

Adversaries use the PowerShell `Get-DomainPolicy` commandlet to enumerate domain password policies for situational awareness and Active Directory discovery, logged via PowerShell Script Block Logging.

Detection of the Kerberos pre-authentication flag being disabled in a user account via Windows Security Event 4738, enabling AS-REP Roasting attacks for offline password brute-forcing.

This rule detects the execution of gpresult.exe with specific arguments to query group policy objects, potentially indicating reconnaissance activity by attackers aiming to understand the Active Directory environment for privilege escalation or lateral movement.

This detection identifies a spike in Active Directory group or object modifications, potentially indicating unauthorized access, defense impairment, or persistence establishment by threat actors.

Detection of Active Directory Group Policy deletion using event ID 5136, indicating potential malicious activity or misconfiguration.

Detects the execution of ADExplorer, a tool used for Active Directory viewing and editing, which can be abused by adversaries for domain reconnaissance and creating offline snapshots of the AD database.

This rule identifies when a User Account starts the Active Directory Replication Process, potentially indicating a DCSync attack, which allows attackers to steal credential information compromising the entire domain.

The execution of AdFind.exe, an Active Directory query tool, is often used by threat actors for post-exploitation Active Directory reconnaissance, as observed in campaigns involving Trickbot, Ryuk, Maze, and FIN6.