Detecting and Mitigating Active Directory Compromises
On September 15th, the Cybersecurity and Infrastructure Security Agency (CISA), Australian Signals Directorate’s Australian Cyber Security Center (ASD’s ACSC), and partners published an article outlining how to detect and mitigate Active Directory threats.
There are plenty of common threats with Active Directory, including credential theft, authentication and domain-wide compromises. Some common techniques used by threat actors for getting the credentials and authentication for Active Directory are Password Spraying, Kerberoasting, and Shadow credentials.
| Name | What is it? | Mitigation Strategy |
|---|---|---|
| Password Spraying | The threat actor attempts to access multiple user accounts using single or multiple passwords until successful. | Create long and unpredictable passwords. Lock out users who fail password checks multiple times. |
| Kerberoasting | Threat actors logged in as a low-threat user; but request a ticket from the controller for a user with higher privilege that is assigned a SPN. They decrypt the password hash sent by the domain controller and logs in as the stolen user. | Minimize users configured with SPNs. Use the zero-trust model and only give users permission for what they require. Enable AES encryption for SPN users (not on by default). |
| Shadow Credentials | A technique used to escalate privilege by editing a “msDS-KeyCredentialLink” attribute on user and computer objects to allow threat actors to gain lateral access, impersonate the object and inherit its permissions. | Ensure only authorized users can edit the msDS-KeyCredentialLink file. Regularly review objects for unauthorized key credentials. |
Your domain may be vulnerable to these attacks and more. The Zero-Trust Model is one good way to mitigate these vulnerabilities.
If you want to learn more about cybersecurity and how to protect yourself, you can go to CISA’s official website.
If you want to learn more about specifically Active Directory and all the other types of ways you can protect your Active Directory, please visit the official CISA article.