decrypting…# 🛡️🔐 Active Directory Security 🎯🧠 #KA > **Active Directory (AD)** is the **core identity and access management** solution in most enterprise networks. > Because of its central role, **securing AD** is mission-critical for defending against both insider and external threats. --- ## 📚 Table of Contents - [📘 What is Active Directory?](#-what-is-active-directory) - [🔓 Why AD Security Matters](#-why-ad-security-matters) - [🧭 Common AD Attack Vectors](#-common-ad-attack-vectors) - [🛠️ Hardening Active Directory](#️-hardening-active-directory) - [🕵️♂️ Detection & Monitoring Tips](#️-detection--monitoring-tips) - [🚨 Signs of AD Compromise](#-signs-of-ad-compromise) - [🧰 Tools for AD Security](#-tools-for-ad-security) - [📎 Recommended Resources](#-recommended-resources) - [⚠️ Disclaimer](#️-disclaimer) --- ## 📘 What is Active Directory? **Active Directory (AD)** is a **directory service** developed by Microsoft for Windows domain networks. It handles: - 👥 User and group management - 🔐 Authentication (Kerberos, NTLM) - 🧾 Policy enforcement via Group Policy Objects (GPOs) - 🖥️ Computer and resource organization AD is essentially the **"central nervous system"** of a Windows environment — and **an attacker’s dream target** if left misconfigured. --- ## 🔓 Why AD Security Matters - 🛑 **1 Compromised AD = Full Domain Takeover** - 🧨 APTs and ransomware groups frequently **target AD** for persistence, lateral movement, and privilege escalation. - 🧬 AD often stores **cleartext passwords**, **misconfigured trusts**, and **overprivileged accounts**. > 🗡️ **Attackers love AD — defenders must know it better.** --- ## 🧭 Common AD Attack Vectors | 🧨 Technique | 🔍 Description | |------------------------|----------------| | 🪪 **Pass-the-Hash** | Reusing NTLM hashes to impersonate users | | 🔁 **Kerberoasting** | Extracting service account tickets and cracking them offline | | 🛠️ **DCSync Attacks** | Using replication permissions to dump password hashes | | 📬 **AS-REP Roasting** | Cracking hashes from Kerberos tickets of non-preauth users | | 🧠 **BloodHound Mapping** | Graph-based AD attack path enumeration | | 🔗 **Unconstrained Delegation** | Abuse of poorly configured delegation settings | | 🎭 **Golden/Silver Ticket** | Forged Kerberos tickets for persistence | --- ## 🛠️ Hardening Active Directory ### ✅ Basic Security Practices - 🔒 Enforce **strong password policies** - 👑 Limit **Domain Admin** privileges - 🚫 Disable **unconstrained delegation** - 🔍 Audit **Service Principal Names (SPNs)** - 📦 Patch **Kerberos & NTLM vulnerabilities** ### 🛡️ Advanced Defenses - 🧯 Implement **Tiered Admin Model** - 🔐 Enforce **LAPS (Local Admin Password Solution)** - 🧾 Monitor **Group Policy changes** - 🚧 Block **cleartext LDAP (389)**; use **LDAPS (636)** - 🔐 Configure **Protected Users** group for high-value accounts --- ## 🕵️♂️ Detection & Monitoring Tips | 📌 What to Monitor | 🔍 Why It Matters | |------------------------------------|-------------------| | 🔁 `Directory Replication Services` | Detect DCSync attacks | | 🔍 `Event ID 4769` | Kerberoasting attempts | | 🛑 `Event ID 4625` | Failed logins (brute force) | | 🗝️ `Event ID 4672` | Admin logons | | 🧰 `Event ID 5140` | File share access | | 🏷️ `Event ID 4726/4720` | Account creation/deletion | > 🎯 **SIEMs**, **Sysmon**, and **Windows Event Forwarding** can help centralize and correlate this telemetry. --- ## 🚨 Signs of AD Compromise - 👻 Unusual logins to **Domain Controllers** - 🧪 `NTDS.dit` file access or replication events - 🧾 GPOs being created or modified without change control - 🦠 Detection of known attack tools like: - Mimikatz - BloodHound - SharpHound - PowerView > 🔥 Treat any of these signs as **high-severity incidents**. --- ## 🧰 Tools for AD Security | Tool | Purpose | |------------------|---------| | 🧠 **BloodHound** | Attack path enumeration | | 📡 **PingCastle** | AD security risk auditing | | 🔍 **ADRecon** | Gathers domain recon data | | 🛡️ **Purple Knight** | Security scorecard for AD | | 🧪 **Mimikatz** | Credential dumping (red team) | | 🔦 **LDAPDomainDump** | Lightweight AD data extraction | | ⚙️ **GPOZaurr** | Audit GPOs for misconfigurations | | 📊 **EventLog Explorer**| Log analysis tool | --- ## 📎 Recommended Resources - 📘 [Microsoft AD Security Guidance](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/ad-security-best-practices) - 📚 [AD Attack & Defense Mindmap](https://github.com/Orange-Cyberdefense/AD-attack-defense) - 🧠 [Harmj0y's Blog](https://posts.specterops.io/) - 📺 [AD Security Training - YouTube](https://www.youtube.com/c/HackTricks/videos) - 🧾 [BloodHound GitHub](https://github.com/BloodHoundAD/BloodHound) - 🔐 [Purple Knight](https://www.purple-knight.com/) - 🛡️ [PingCastle](https://www.pingcastle)