Top 20 Active Directory (AD) Attack Methods

Active Directory (AD) is a critical component in many organizations, providing centralized management of user accounts, computers, and other resources. However, it is also a prime target for attackers.

Here are the top 20 AD attack methods:

Password Spraying
Default Credentials
Kerberoasting
Privilege Escalation
LDAP Reconnaissance
BloodHound Reconnaissance
Local Loop Multicast Name Resolution (LLMNR) Poisoning
Mimikatz
Hard-Coded Credentials
NTDS.dit Extraction
Pass-the-Hash
Pass-the-Ticket
Golden Ticket Attack
Silver Ticket Attack
Skeleton Key Attack
DCShadow Attack
AS-REP Roasting
SID History Injection
DCSync Attack
AdminSDHolder Exploitation

1. Password Spraying: This method involves attempting common passwords across many accounts to avoid lockouts. Attackers use a list of commonly used passwords and try them against multiple accounts, hoping to find a match.

2. Default Credentials: Many AD environments have devices or applications with unchanged default passwords. Attackers exploit these default credentials to gain access to the network.

3. Kerberoasting: Attackers extract service account hashes from AD and attempt to crack them offline. This method targets service accounts with weak passwords.

4. Privilege Escalation: Attackers exploit misconfigurations or vulnerabilities to gain higher-level privileges within the AD environment. This can involve exploiting weak permissions or vulnerabilities in software.

5. LDAP Reconnaissance: Lightweight Directory Access Protocol (LDAP) queries are used to gather information about users, groups, and computers in AD. This information can be used to plan further attacks.

6. BloodHound Reconnaissance: BloodHound is a tool that maps AD relationships to find paths to privilege escalation. It helps attackers identify the shortest path to high-value targets.

7. Local Loop Multicast Name Resolution (LLMNR) Poisoning: Attackers poison LLMNR to intercept and relay AD authentication. This can be used to capture credentials or perform man-in-the-middle attacks.

8. Mimikatz: This tool extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memory. It is widely used by attackers to obtain credentials from compromised systems.

9. Hard-Coded Credentials: Attackers exploit passwords stored in scripts or applications. These hard-coded credentials can provide easy access to the network.

10. NTDS.dit Extraction: The NTDS.dit file is the AD database file that contains user hashes. Attackers extract this file to obtain credentials for all users in the domain.

11. Pass-the-Hash: This method involves using NTLM hashes to authenticate as a user without knowing the plaintext password. Attackers can use captured hashes to move laterally within the network.

12. Pass-the-Ticket: Attackers use captured Kerberos tickets to access resources as the ticket’s owner. This method allows attackers to impersonate users without needing their passwords.

13. Golden Ticket Attack: Attackers forge Kerberos Ticket Granting Tickets (TGTs) to gain domain-wide access. This method provides attackers with long-term access to the network.

14. Silver Ticket Attack: Attackers create forged Kerberos service tickets to access specific services. This method targets individual services rather than the entire domain.

15. Skeleton Key Attack: Attackers inject a backdoor password into AD, allowing them to log in as any user. This method provides persistent access to the network.

16. DCShadow Attack: Attackers mimic a Domain Controller to replicate malicious changes to AD. This method allows attackers to make unauthorized changes to the AD schema.

17. AS-REP Roasting: Attackers extract Kerberos AS-REP responses to crack user passwords offline. This method targets accounts that do not require pre-authentication.

18. SID History Injection: Attackers inject old Security Identifiers (SIDs) to inherit previous privileges. This method allows attackers to escalate privileges by leveraging historical SIDs.

19. DCSync Attack: Attackers use replication protocols to extract credentials from AD. This method allows attackers to impersonate a Domain Controller and request password hashes.

20. AdminSDHolder Exploitation: Attackers modify the AdminSDHolder object to persistently elevate privileges. This method ensures that changes to high-privilege accounts are not reverted.

Conclusion

Understanding these attack methods is crucial for securing AD environments. Organizations should implement strong security measures, such as regular password changes, monitoring for unusual activity, and applying patches and updates, to protect against these threats.

By staying informed and proactive, organizations can better defend their AD infrastructure from attackers.

You may also like: